DevSecOps Enablement for a Re-Insurance Client in the US

Business Ask

Implementation of DevSecOps using Azure DevOps, SAST and DAST security tools for 160+ applications.

Client Requirement

• Implementation of DevSecOps Process encompassing the complete integration of Security tools in the CI/CD pipeline
• Security Assessment of 160 Web applications and Mobile Applications
• Analysis of false positives and removal of gigantic false positive numbers to speed up remediation
• Secure coding guidelines and remediation suggestions for vulnerabilities

LTM Solution

• End-to-End implementation of DevOps using Azure DevOps Build & Release Pipelines, automated quality control gates via Security tools integration & approval workflow
• Successfully deployed Microfocus Fortify and Checkmarx tool in the Azure DevOps environment
• Performed automated source code review scans & DAST scans of more than 160 Web & Mobile Applications
• Performed manual source code reviews and manual DAST approach such as API Testing for deeper security whenever required
• Established a dashboard for tracking the real-time security posture of applications in the DevOps pipeline
• Performed false positive analysis of all applications that were scanned for SAST & DAST
• Provided remediation advice to development teams for remediation of vulnerabilities

Key Highlights

• 160+ Web & Mobile Applications
• 300% Insurance Sector Client
• 40+ Remediation & AMS team size
• 2500+ One DevOps Platform

Value Delivered

01
Completed transition of DevSecOps

02
800,000 Vulnerabilities tagged and reviewed across 160+ apps

03
60% Reduction in False Positives

04
300,000 Vulnerabilities fixed by assisting Dev team

05
30% Faster ticket resolution

Tools & Technologies

The image lists various tools and technologies used in the solution, including:

• VS Code
• Checkmarx
• Azure Repos
• Sonar
• MSBuild
• Ansible
• Azure Artifacts
• Puppet
• Git
• Azure Test Plans
• Azure Pipelines
• Burp Suite
• Azure DevOps
• Selenium
• JFrog Artifactory
• Maven
• PMD
• OWASP ZAP