Application Security Testing for one of the Leading Health Technology Company in US

Scope

The scope of the work includes performing on-demand security testing that includes, 

• Security Code Review (SCR)
• Web Application Manual Testing (WAMT)
• IT Infrastructure Vulnerability Assessment and Penetration Testing (VAPT)
• Mobile Application Security Testing (MAST)
• Web Services Security Testing (WSST)
• Guided DAST (Dynamic Application Security Testing)
• Guided Web Services Security Testing (WSST)

Volumetrics/Key Takeaways

• SAST100+ Yearly
• DAST10+ Yearly
• Application PT 200+ Yearly
• Infrastructure PT 5+ Yearly
• Mobile App PT 5+ Yearly
• Web Services Testing 25+ Yearly

Key Challenges

As a long-standing client partner for more than 3 years, we understand the client’s key business drivers impacting security. The key challenges they faced were as follows:

• No security testing was performed during development and in-sprint
• Ineffective vulnerability management operation 
• High number of false positive alerts
• No defined approach to consult for security testing
• Complex policies and processes

LTM Solution

• Performed in-depth analysis of the client’s current security architecture operation 
• Defined process for continuous security assessment across the software development lifecycle 
• Deployed Qualys Web Application Scanning (WAS) in the Azure DevOps environment to detect vulnerabilities on all networked assets, including servers, network devices etc. 
• Proposed automation of dynamic and web application security testing 
• Implemented In-Sprint CI/CD-based dynamic security testing execution using Azure DevOps 
• Performed different levels of testing based on the complexity of applications and implemented continuous security testing

Benefits

• 65% Reduction in the overall efforts for the security testing program
• 300% Increase in the quality of defects using DevSecOps automation
• 70% Reduction in False Positives
• 2500+ Vulnerabilities found and remediated 
• Reduced time to mitigate vulnerabilities and avoid slippages 
• Improved security testing workflow and plan
• Reduced effort required for performing dynamic security testing