Legacy Violations Best Practices
Legacy Violations Best Practices
Focus enforcement and remediation on the violations where they matter most
- Configuring enforcement without breaking legacy applications
- Focus reporting on the most important risk
- Giving development time to remediate while alerting to new risk
Use Legacy Violations to accept application risk for legacy applications
- Enforcement is a challenge when applications are onboarded periodically
- Legacy applications, that are infrequently built, seldom have the bandwidth to remediate technical debt
- Use Legacy Violations to accept the current risk of applications
- Continuous Monitoring to monitor new risk as it is discovered
Use Legacy Violations to reduce noise when onboarding applications
- The default configuration for Legacy Violations is on policies with a threat level of 7 or lower
- This will effectively waive all risks with a lower threat
- This allows development teams to focus on critical and high-risk violations that present the most risk to the organization
- This configuration can be modified per policy
- The default policy may be configured to accept all risks including policies that are set to fail
Enable Legacy Violations override for child Organizations and Applications
- Legacy Violations typically should be configured at the root organization level
- Allow Legacy Violations to be overridden at the organization level for teams that do not need it
Add Legacy Violations to the backlog
- Legacy Violations are still risks that should be remediated
- Add Legacy Violations to the backlog to ensure they still get addressed
Socialize when Legacy violations will be revoked
- Legacy violations may be hidden in the scan report, however, the risk does not go away
- As a best practice, legacy violations should have a plan for review, and the appropriate remediation actions made
- The risk that will continue to be accepted is replaced with time-based waivers going forward
- Applications may have their legacy violations revoked at any point, but this will have to be done manually through the UI