Global Software Leader: The Benefits of AcuSensor

AcuSensor greatly increases the accuracy of our scans and the logs contain detailed information about the location of the vulnerability in source code. This helps our developers find the vulnerabilities and fix them quickly.

The Challenge: Securing Mission-Critical Microservices in a Complex Environment

Our customer, who has asked to remain anonymous for security reasons, is a global software leader with over 100,000 employees worldwide, developing enterprise software to manage business operations and customer relations. It is one of the world’s largest publicly-traded software companies and was founded in 1972.

Like many major software vendors, our client began by selling on-premises solutions but then fully embraced cloud technologies, becoming a global cloud leader. At the moment, all of their products are web applications (SaaS) and approximately half of them are based on microservices and APIs. Web application security is a major concern that must be addressed at every stage of software development.

Like most large enterprises, our client’s environment is very complex and they rely on multiple security solutions. Their existing web application security solutions were not thorough and precise enough, so they approached Invicti to learn more about our unique AcuSensor IAST technology. They wanted to scan their APIs early in the SDLC using IAST. The challenge was to fully automate the process in a very complex environment that includes custom solutions.

The Solution: Docker, Kubernetes, and the Invicti API

The customer wanted to test their APIs at the earliest possible stage by running scans as part of CI/CD pipelines. To do this, they created 10 specific target environments to be used to test APIs in development. These target environments are containers where the Jenkins CI/CD platform deploys the API to be tested.

Nine of the customer’s targets have a fixed URL, but one of them is used for microservices that cannot be simply deployed to the fixed-URL targets. The tenth target is based on a fixed proxy server that routes HTTP traffic from the proxy port to the target instance of the microservices application in the CI/CD environment.

A common Docker image is created for all test targets. This Docker image stores the acusensor.jar and aspectweaver.jar files. The deployment environment either uses this image as an intermediate stage to copy the required files into the target deployable Docker image or relies on Kubernetes init containers to copy these two key files into the target environment.

Once the Docker image with the API is ready for testing, the Jenkins pipeline updates the predefined Invicti target. It uses the Invicti API to replace the current definition with an appropriate Swagger file for the API being tested and to configure custom headers to include application-related authorization details. Then, Jenkins runs the Invicti+AcuSensor scan using the Invicti API.

Once the scan is complete, the Jenkins pipeline accesses the scan result to get the vulnerabilities. The Jenkins pipeline does not use the Invicti API to create the tickets. Instead, it has its own logic and customized Jira fields to create Jira tickets. The ticket criteria match Invicti confidence 100 or CVSS >=7.

While Invicti provides vulnerability management functionality, the client chose not to use these capabilities due to having a centralized vulnerability management solution. Therefore, vulnerabilities are tracked in the internal vulnerability management system that is fed using detailed Invicti logs as well as Jira tickets.

Benefits

• Accuracy
  The combination of Invicti confidence rating, proof-of-exploit, and AcuSensor back-end information allows the customer to pass information from Invicti directly to developers – vulnerabilities do not have to be double-checked manually.
  
• Developer Productivity
  With AcuSensor pinpointing issues down to the line number, the developer does not need to waste time looking for the vulnerability in the source code. With proof of exploit, they can immediately see what the vulnerability leads to.
  
• Flexibility
  Thanks to the capabilities of the Invicti API, the customer was able to easily integrate all Invicti functionality within their existing environment without the need to use the Invicti UI or the built-in vulnerability management system.