A prominent UK telecommunications and media company has enhanced its operational efficiency and risk management capabilities through a collaboration with RiverSafe.
The firm faced challenges with dispersed security data across multiple tools, necessitating considerable time for developers, security teams, and executives to navigate diverse platforms for crucial vulnerability information. The fragmented visibility of the organisation's security environment was impacting development speed and effectiveness.
Addressing security data challenges
RiverSafe stepped in to streamline data access and facilitate better operational efficiency
The absence of a centralised view of security vulnerabilities hindered developers’ ability to efficiently identify and resolve security issues.
In addition, the disjointed CI/CD pipelines further complicated matters, leading to increased frustration among development teams and a higher risk of unaddressed vulnerabilities. RiverSafe stepped in to streamline data access and facilitate better operational efficiency.
Implementing effective solutions
RiverSafe introduced an integration script that automates the notification of security vulnerabilities to developers' pull requests without requiring them to access multiple security platforms.
This script channels the necessary data, aiding developers in maintaining secure codebases more effectively. Subsequently, RiverSafe's consultants collaborated with the client to centralise security insights using a comprehensive pane-of-glass tool.
Enhanced insight and reporting
RiverSafe's solution supports various security operations such as SAST, SCA, and Secret Scanning
The integrated tool enables developers to view repositories and projects collectively, offering management detailed oversight of vulnerabilities’ impacts on products and individual repositories. It includes a scoring system that alerts developers to any potential security inadequacies, allowing for prompt corrective action.
RiverSafe's solution supports various security operations such as Static Application Security Testing (SAST), Source Code Analysis (SCA), and Secret Scanning, all while minimising infrastructure maintenance through serverless AWS deployment.
Centralised repository visibility
By consolidating data from over 22,000 code repositories, the tool facilitates a comprehensive view of security information, common vulnerabilities, and allows trend analysis. This centralisation significantly reduces the time spent by developers and other stakeholders in searching for vulnerability data, leading to a more streamlined development process.
The enhanced visibility has notably improved response times to zero-day vulnerabilities, shifting from potentially weeks to immediate identification and resolution.
RiverSafe continues to enhance this tool, focusing on improved analytics, alert methods, and the centralisation of CI/CD pipelines to support the growing needs of the client. This ongoing collaboration aims to further boost operational efficiency and security posture, greatly benefiting the UK telecommunications giant.
The client, a British media and telecommunications company, was looking to increase operational efficiency, save time spent on identifying and addressing vulnerabilities and reduce risk by increasing visibility across their environment.
With multiple security tools in different places, security data was siloed and needed to be accessed separately. This led to long periods of time spent jumping between tools to find data, and a lot of context switching when it came to looking at the results. Developers, security teams and senior directors were forced to search in multiple places for critical, often time-sensitive information about vulnerabilities.
Risk of vulnerabilities
Not only did this eat into their valuable time, but it also meant they had no overall visibility into the organisation’s security posture. This lack of visibility significantly hampered the development process, as developers struggled to locate and address security issues.
In addition, the organisation did not have centralised CI/CDs, instead running different pipelines for individual developers or teams. Combined with poor visibility, this lack of efficiency was causing major frustration for the development team, slowing down development and increasing the risk of vulnerabilities in the code going undetected.
The solution
RiverSafe was initially brought on board to address the issue of decentralised security data, and help improve operational efficiency. The team’s goal was to allow for the results to be sent directly to the developers without them needing to access and search multiple security platforms to find the information they needed.
The RiverSafe team created an integration script for the developers to execute when they were running their pipelines. Once triggered, the script would send a notification to a server that RiverSafe had specifically designed, which collated the identified vulnerabilities and relayed them back to the developers’ pull request. This ensured the development team got the information they needed to improve the security of their code.
The next phase: Developing the data insights
RiverSafe consultants worked alongside the client’s team to take all the security data that was being collected and, rather than sending it to individual developers’ pull requests, instead created and directed it to a pane-of-glass tool.
This tool allows the developers to log in and see their repositories and projects in one place. For management, it allows them to have a complete picture of all the vulnerabilities and what they are impacting, on both individual repositories or a given product.
The tool also allows them to build reports and includes a scoring model to give a visual rating so everyone can easily see if their repositories are secure or not. The scoring system, ranging from insecure to excellent sends alerts to let the developers know if their repositories fall below a certain level so they don’t need to continually monitor themselves. The RiverSafe team also provides advice on the steps that should be taken to remediate any identified vulnerabilities.
Multiple security operations
A key requirement of this tool was that it supported multiple security operations, including SAST (Static Application Security Testing), which would look at code smells and general quality of life, Source Code Analysis (SCA), which would look at which libraries are being used and also Secret Scanning to look for secrets in the code.
RiverSafe also wanted to ensure that all of this is serverless on AWS to minimise the time spent on infrastructure maintenance. After launching, RiverSafe continued to work on improving this tool, making quality improvements, performing maintenance, and enhancing the integration via the shell scripts.
The outcome
The tool now brings together data from over 22,000 code repositories into one centralised place, allowing the client to see all of their security information, what libraries were most common, where the vulnerabilities were, and to start looking for trends.
Developers and other stakeholders no longer need to scour multiple locations for vulnerability data, saving the company huge amounts of time and making its development process more efficient. With the bespoke script in place, the data comes to them. This increase in visibility has also led to improvements in response times to zero-day vulnerabilities. Previously, it could take weeks or even months to find all the affected repositories.
However, since implementing RiverSafe’s custom tool, the team has been able to locate repositories featuring the vulnerable package immediately and remediate any issues quickly, massively improving their overall security posture. Thanks to this uplift in operational efficiency, the development team is now able to spend more time improving their code. RiverSafe and the client’s team are now working on expanding coverage throughout the organisation, improving analytics and alerting, and centralising CI/CD pipelines.
