SECURITY
FRAMEWORK

Our security framework provides complete protection across the SDLC, utilising open source & commercial tooling in order to de-risk your product deployments. It incorporates:

Static Application Security Testing (SAST)

• SAST tools scan raw source code, for coding errors & flaws which could lead to exploitable vulnerabilities 
• SAST tools can also be used to standardise code writing & can work in the developers interactive development environment (IDE) providing instant feedback
• SAST tools are primarily used during the code, build, & test phases of the software development life cycle (SDLC)

Software Composition Analysis (SCA)

• SCA tools scan open-source & third-party components for known vulnerabilities. They also provide insight into security & license risks to accelerate prioritisation & remediation efforts
• SCA tools are primarily used during the build & test phases of the SDLC

Automated Testing

• Automating application testing is vital for interactive application security testing (IAST) & dynamic application security testing (DAST) products to fully analyse the application before production deployment. If the application is not fully analysed, application vulnerabilities & testing backdoors can be missed, exposing the application & user data
• Automated testing is primarily used during the test phase of the SDLC

Tool Reporting Consolidation

• Using multiple tools can create a product backlog nightmare, with several different consoles holding different data & even requiring manual intervention to send to a single ticketing system
• It’s important to remember this & develop a way to consolidate the defect findings from SAST, SCA, IAST, automated testing & DAST for application & product owners to understand & prioritise remedial actions

Continuous Integration/Continuous Deployment (CI/CD) Pipelines

• CI/CD is a method to constantly build, test & deliver apps by automation within the SDLC. With consistency in the integration process, teams can commit code changes more rapidly, leading to better coding quality & a reduction in application release

Runtime Application Security Protection (RASP)

• RASP tools operate within the application runtime engine & act as intrusion detection (IDS) or intrusion protection (IPS)
• RASP can detect, alert & block advanced persistent threats (APT), which some web application firewalls (WAF) can miss
• RASP tools are primarily used during the operate & monitor phases of the SDLC

Dynamic Application Security Testing (DAST)

• DAST tools scan the application from the outside by crawling your web application or API for known web vulnerabilities
• The application is scanned over a network connection & can examine the network & client-side
• DAST tools can use Selenium scripts to interact with your website or service & find vulnerabilities
• DAST tools are primarily used during the test & operate phases of the SDLC

Self Security Governance Framework

• Rather than the security team being included in every application release, the security team can provide a framework, covering the use of tools such as SAST, SCA, DAST, IAST & vulnerability remediation metrics
• A self-security governance framework can enable speedy & secure application releases
• The security team can use centralised reporting, to showing a continuous assessment of current application vulnerabilities

Interactive Application Security Testing (IAST)

• IAST tools operate in the application runtime & analyse application behaviour based on manual or automated tests
• IAST tools detect vulnerabilities at runtime & provide detailed insight for developers. By highlighting the library or function, & line of code where the issue occurred. This enables developers to focus their time & effort on critical findings
• IAST tools are primarily used during the code & test phases of the SDLC

Get in touch via transformation.frameworks@sqa-consulting.com for more information.