DevSecOps Enablement for a UK-based Insurance Company

Scope

• Security Assessment of 160 Web and Mobile Application
• Process Definition 
• Tools installation & configuration
• Implementation of DevSecOps Process
• Secure coding guidelines and remediation suggestion for vulnerabilities

Key Takeaways

• Security Assessment of 160 Web and Mobile Applications
• 800,000 Vulnerabilities tagged and reviewed across 160+ apps

Key challenges

• High Vulnerability Count
• Aged vulnerabilities that needed immediate fix
• Issues in tracking remediation

Solution highlights

Experiential dashboard for tracking the real-time security posture of applications in DevOps pipeline

• End-to-end implementation of DevOps using Azure DevOps build & release pipelines, automated quality control gates via security tools integration & approval workflow
• Deployment of Microfocus Fortify and Checkmarx tool in the Azure DevOps environment
• Performed false positive analysis of all applications that were scanned for SAST & DAST
• Provided remediation advice to development teams for remediation of vulnerabilities

Business benefits

• 60% reduction in False Positives
• 800,000 Vulnerabilities tagged and reviewed across 160+ apps
• 40% Faster ticket resolution
• Provided remediation advice to development teams for remediation of vulnerabilities