I work as the team lead of the IT Security team where I work. A major part of my job duties is leading vulnerabilities scanning, management, and remediation validation. I frequently interact with other teams, with significant amount of interaction with development teams and QA.
Yesterday, I was working together with our QA team to validate business requirements before application changes were released to our production environment. One of the security requirements is that certain security controls be implemented into the code to mitigate a basic set of vulnerabilities (think OWASP Top 10 for example), but as security was not involved early enough in the requirements gathering / story design phase prior to development, this requirement was not clearly captured in the user story.
Through testing results from tools such as SonarQube and Burp Suite, security requirements were not met. Multiple vulnerabilities still remain exploitable and tools to exploit these are freely available. As a result of the security requirements not being captured in user story, I anticipate push back from development that this is not a fair request. Starting a new feature request would take much more time and would most likely jeopardize timely release, with business stakeholders (non IT) who are using this software being unhappy. Both my team, QA, and my manager agree that this is a critical issue that should be fixed prior to release. If this vulnerability is exploited, sensitive customer data could be leaked. I am still researching to see if the vulnerability is in the wild at this time.
How do I communicate to the development team that the security vulnerability must be fixed before release, while acknowledging that this request is not exactly within the scope of original user story? I want to avoid undue delay in remediation and not escalate if I don't absolutely have to.