Application Security Testing Orchestration

What is Intelligent Orchestration?

Intelligent Orchestration (IO) is a dedicated application security pipeline that runs in parallel to the development or production pipeline. This customized AppSec pipeline automates security testing throughout the entire software development life cycle (SDLC)—not just a few stages. It automatically runs the right security tools or triggers manual testing activities based on how significant the code changes are, the total risk score, and a company’s own security policies. This enables security teams to easily implement security processes and policies for all applications across their organization, at enterprise scale. 

What problems does IO solve?

Head of development

Security scans can slow down continuous integration / continuous delivery (CI/CD) pipelines, and scan automation often requires that many different AppSec tools are run for each build of software, regardless of the actual code changes or their criticality. This causes friction and can reduce development velocity. 

The results from all these scans also can cause an overload of vulnerability information for developers, who frequently must decide by themselves which ones to fix or filter out. And development leads often don’t get immediate notifications of critical vulnerabilities that can/should break builds. In addition, there’s no continuous feedback or guidance from the security team to developers on which types of vulnerabilities have highest priority for their projects. 

Head of security

It’s challenging for security leads to enforce their security policies across thousands of applications. Additionally, many of these policies are contained in spreadsheets or PDFs, so they're difficult to enforce and scale. Automating manual security activity reminders (e.g., manual code reviews or threat models) by project or by application criticality is another area of difficulty. Security leads also can’t easily implement security gates on what matters most to them, and they often have poor visibility into the most critical application risks across the portfolio. And these critical application risks aren’t linked to or enforced by security policies. 

Application Security Testing Orchestration | Synopsys

How does IO work?

Easy integration with existing pipelines and development toolchains. IO seamlessly connects to pipelines through simple API calls. There’s no need to completely reimplement build or release pipelines to add security testing. DevOps integrations allow security analysis to easily deliver results in tandem with other development, security, and tracking tools already in place.

Actions determined and executed in real time. IO helps ensure that the right tests are run at the right time. After security teams define AppSec policies as code (e.g., readable XML files), the patented technology in IO uses those security rules to evaluate code changes and other SDLC events, and intelligently trigger the appropriate AppSec security tests (e.g., static application security testing, software composition analysis, dynamic application security testing, interactive application security testing). The right tests are performed at the right times (or not at all), depending on the actual code changes, the calculated risk score, and a company’s own security policies. This saves time and resources.

Automated workflow for manual or out-of-band AppSec activities. IO also uses your policies to trigger manual AppSec activities, such as penetration tests, through existing defect-tracking systems and communication channels, enabling security teams to coordinate security compliance with development workflows.

The right information to the right teams. IO provides optimized and prioritized results based on risk and the criteria predetermined by security or development teams (e.g., only critical vulnerabilities or only critical SQLi vulnerabilities). Results are filtered directly into the development and defect-tracking tools that development teams already use, avoiding vulnerability overload. 

What key capabilities does IO offer?

A dedicated security pipeline. IO isolates security testing from the main development pipeline. Its dedicated CI pipeline integrates easily with development pipelines and triggers the appropriate security analysis based on SDLC events. 

Policies as code. IO automates the enforcement of security and risk policies within the intelligent pipeline and enables organizations to define the rules for policy evaluation, response, and notification as code. Security teams can easily implement security gates into development workflows, so they're automatically notified if critical vulnerabilities are identified during the build process. And they must provide approval prior to a production release.

Security workflow automation. IO automates the initiation and management of standard application security testing (AST) as well as manual out-of-band AppSec activities through the standard defect-tracking systems and communication channels development and security teams use today. 

Extensible integrations. IO integrates security analysis and results seamlessly into existing development tools and platforms. 

AST analytics. IO delivers access to metrics that can help identify gaps and demonstrate the effectiveness of AST/DevSecOps implementations. 

How can Synopsys help?

Synopsys’ industry-leading Intelligent Orchestration is a best-in class offering, providing a seamless fix for DevSecOps development pain points. To learn more about how it can help you or about how IO solves today’s modern development struggles, visit https://www.synopsys.com/software-integrity/intelligent-orchestration.html