AppSec 2.0: Security Without the Noise

As a leading fintech company, we take application security very seriously. Having Deepfactor’s integrated solution for open-source scanning, container scans and runtime security has been a great way to consolidate multiple AppSec tools into a simple, effective solution.

If only every company could be like Deepfactor, I think the world would be a better place.

With the Deepfactor AppSec platform, we were able to easily run Docker container image scans and pinpoint high-risk vulnerabilities quickly. Additionally, the Deepfactor team is great to work with—they listen to our needs and are very responsive to our requests.

Deepfactor definitely shines when compared with existing solutions, and the simplicity and the fact that you can easily run it on premise and provide the flexibility to either add it on the left or the right brings a lot of value.

SBOMs help organizations to determine if they are susceptible to security vulnerabilities previously identified in software components. These components could be internally developed, commercially procured or open-source software libraries. SBOMs generate and verify information about code provenance and relationships between components, which helps software engineering teams to detect malicious attacks during development (e.g., code injection) and deployment (e.g., binary tampering).

The team is so busy with developing new features they didn’t want the additional overhead of looking at security defects. There could be a deluge of false positives. We needed the right tooling. We told AppSec – ‘If you don’t have a test case associated with a particular container, there’s a strong likelihood we’re going to miss out on identifying these vulnerabilities.’

Properly implemented, cloud-native applications will be the most secure applications your organization has ever developed and deployed. But you must discard the baggage of your conventional thinking, tools and processes for security.

Firms that want to secure applications are challenged by understaffed security teams and lack of security awareness on the part of developers. Developer security champions are developers who act as a security point of contact in their team and embed.