Eureka DevSecOps Solution

The technology, people, and processes your DevOps team needs to achieve security at speed

Whether you’re building a new application from the ground up or driving the growth of an existing product, embedding security into your DevOps process is an essential way to save your team time and cost, while setting your organization up for long term success

Built as security rocket fuel, our Eureka DevSecOps Managed Service Solution has been developed in alignment with OWASP ASVS to provide your DevOps teams the people, processes and technology needed to build your security program from the ground up, while maintaining speed in your agile software development life cycle (SDLC).

The Building Blocks of DevSecOps

People

We’ll assign a dedicated security consultant who will champion your security efforts throughout the entire secure SDLC process. They will integrate closely with your team to provide support through weekly security stand-ups, sprint planning sessions, and additional guidance as needed.

Outside of your dedicated security consultant you will have full access to Forward Security’s team of application & cloud security experts to ensure your security needs are covered from end-to-end.

Processes

We’ll work closely with your team to instill the knowledge and industry leading practices needed to build security fundamentals into your day-to-day processes. This includes the adaptation of OWASP’s secure coding practices, along with their Application Security Verification Standard (ASVS).

Periodically through our annual engagement the Forward Security team will host formal training sessions with your team to cover topics such as secure application development, security awareness, and threat modelling.

Technology

During the discovery process our team will work to identify the right mix of security tools for the on-going success of your business. These tools can cover: Static Code Analysis, Dependency Checking, Dynamic App Scanning, Infrastructure Scanning, and TLS Scanning.

Our proprietary Eureka DevSecOps Platform will be implemented, containing the selected tools, which can be easily deployed into your environment, becoming a long-term asset for your business.

DevSecOps-Maturity-Assessment-Banner

Software Security Touchpoints

Our Service Packages:

Level 1Level 2Level 3
» Ideal for organizations:Without internal application security expertise, building a traditional, web, or mobile applicationWithout internal application security expertise, building a traditional, web, or mobile application, and require a higher level of application security maturity through adoption of standards.Without internal application security expertise, building a traditional, web, or mobile application, and require a higher level of application security maturity through adoption of standards and continuous threat modelling.
Technology
» Code security analysis:Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube*Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube*Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube*
» 3rd party component vulnerability scanning: OWASP Dependency Check, MergeBase scanner (unlimited scans)*OWASP Dependency Check, MergeBase (unlimited scans, component level blocking)*OWASP Dependency Check, MergeBase (unlimited scans, component level blocking)*
» Dynamic application security testing:OWAP ZAPOWAP ZAPOWAP ZAP
» Infrastructure scanning:OpenVAS, NessusOpenVAS, NessusOpenVAS, Nessus
» SSL/TLS configuration analysis:SSLyzeSSLyzeSSLyze
People
» Dedicated Subject Matter Expert + access to our Center of Excellence:12 hrs/month18 hrs/month24 hrs/month
Process
» Security Training:Secure development & threat modelling training (twice per year)Secure development & threat modelling training (quarterly)Secure development, threat modelling training and workshops (quarterly)
» Adoption of security requirements and processes (based on ASVS)BasicStandardAdvanced

*Open source tools are included and many commercial tools can be incorporated upon request (Paid licenses are the client’s responsibility)