Application Security Testing Orchestration

Head of development

Security scans can slow down continuous integration / continuous delivery (CI/CD) pipelines, and scan automation often requires that many different AppSec tools are run for each build of software, regardless of the actual code changes or their criticality. This causes friction and can reduce development velocity. 

The results from all these scans also can cause an overload of vulnerability information for developers, who frequently must decide by themselves which ones to fix or filter out. And development leads often don’t get immediate notifications of critical vulnerabilities that can/should break builds. In addition, there’s no continuous feedback or guidance from the security team to developers on which types of vulnerabilities have highest priority for their projects. 

Head of security

It’s challenging for security leads to enforce their security policies across thousands of applications. Additionally, many of these policies are contained in spreadsheets or PDFs, so they're difficult to enforce and scale. Automating manual security activity reminders (e.g., manual code reviews or threat models) by project or by application criticality is another area of difficulty. Security leads also can’t easily implement security gates on what matters most to them, and they often have poor visibility into the most critical application risks across the portfolio. And these critical application risks aren’t linked to or enforced by security policies. 

Easy integration with existing pipelines and development toolchains. ASTO seamlessly connects to pipelines through simple API calls. There’s no need to completely reimplement build or release pipelines to add security testing. DevOps integrations allow security analysis to easily deliver results in tandem with other development, security, and tracking tools already in place.

Actions determined and executed in real time. ASTO helps ensure that the right tests are run at the right time. After security teams define AppSec policies as code (e.g., readable XML files), the patented technology in ASTO uses those security rules to evaluate code changes and other SDLC events, and intelligently trigger the appropriate AppSec security tests (e.g., static application security testing, software composition analysis, dynamic application security testing, interactive application security testing). The right tests are performed at the right times (or not at all), depending on the actual code changes, the calculated risk score, and a company’s own security policies. This saves time and resources.

Automated workflow for manual or out-of-band AppSec activities. ASTO also uses your policies to trigger manual AppSec activities, such as penetration tests, through existing defect-tracking systems and communication channels, enabling security teams to coordinate security compliance with development workflows.

The right information to the right teams. ASTO provides optimized and prioritized results based on risk and the criteria predetermined by security or development teams (e.g., only critical vulnerabilities or only critical SQLi vulnerabilities). Results are filtered directly into the development and defect-tracking tools that development teams already use, avoiding vulnerability overload. 

A dedicated security pipeline. ASTO isolates security testing from the main development pipeline. Its dedicated CI pipeline integrates easily with development pipelines and triggers the appropriate security analysis based on SDLC events. 

Policies as code. ASTO automates the enforcement of security and risk policies within the intelligent pipeline and enables organizations to define the rules for policy evaluation, response, and notification as code. Security teams can easily implement security gates into development workflows, so they're automatically notified if critical vulnerabilities are identified during the build process. And they must provide approval prior to a production release.

Security workflow automation. ASTO automates the initiation and management of standard application security testing (AST) as well as manual out-of-band AppSec activities through the standard defect-tracking systems and communication channels development and security teams use today. 

Extensible integrations. ASTO integrates security analysis and results seamlessly into existing development tools and platforms. 

AST analytics. ASTO delivers access to metrics that can help identify gaps and demonstrate the effectiveness of AST/DevSecOps implementations. 

Synopsys’ industry-leading Intelligent Orchestration (IO) is a best-in class ASTO solution, providing a seamless fix for DevSecOps development pain points. To learn more about how it can help you or about how IO solves today’s modern development struggles, visit https://www.synopsys.com/software-integrity/intelligent-orchestration.html