What To Know
- By helping to identify and fix software problems early in the development process, Coverity Static Analysis not only accelerates FPT code reviews to improve code quality and security but also helps FPT reduce the need and cost of addressing those problems later.
- The decision to implement an SCA solution is further supported by the findings of the 2020 Open Source Security and Risk Analysis (OSSRA) report where 99% of codebases audited by the Black Duck Audit team in 2019 contained open source.
Editor’s brief: Leading Vietnamese tech and software group FPT Software, headquartered in Hanoi, has chosen application security leader Synopsys’ Application Security Testing tools to improve its code quality and security. Read more below.
SINGAPORE – Synopsys, Inc., a recognised leader in application security, recently expanded security testing support for FPT Software, guiding them in identifying and fixing software problems early in the software development process.
FPT Software offers full lifecycle services for its customers, including software design, development, migration and modernisation. Providing software components for clients’ systems often means working with legacy code and architectures not originally designed for modern interconnected environments. These must be stringently tested for the quality and security needed by today’s modern applications.
“Winning clients’ trust is our utmost priority, and we constantly focus on enhancing code security,” says Do Van Khac, Chief Delivery Officer and Executive Vice President at FPT Software. “We often encounter risks stemming from incompatible legacy code and architectures, which led to increased costs in remediation. We took the path of looking into tools to improve code quality and security as early as possible in the development lifecycle.”
By helping to identify and fix software problems early in the development process, Coverity Static Analysis not only accelerates FPT code reviews to improve code quality and security but also helps FPT reduce the need and cost of addressing those problems later.
With the growing use of open source components and libraries in software development, FPT customers requested that the company extend their software testing to include software composition analysis (SCA). FPT implemented Synopsys’ Black Duck SCA in 2019, and today FPT uses Coverity and Black Duck for virtually all their software project testing.
The decision to implement an SCA solution is further supported by the findings of the 2020 Open Source Security and Risk Analysis (OSSRA) report where 99% of codebases audited by the Black Duck Audit team in 2019 contained open source. Additionally, 100% of the codebases from nine of the 17 industries covered in the research contained at least one open source component.
As the open source community issues feature updates and security patches, organisations need to have a way in which to identify, track, and responsibly manage legal open source use with its increasing presence in commercial software. These may include license identification, a process to patch known vulnerabilities, and policies to address outdated and unsupported open source packages.
An alarming number of companies consuming open source components do not apply security patches, opening their businesses to potential cybersecurity incursions and exploits.
“With the acceleration of technology adoption and online solutions during the pandemic, businesses will seek efficiencies in application development by leveraging increased use of open source technologies. Security, updates, patches and licensing obligations could introduce unexpected risks, which is why open source usage needs to be managed differently than that of commercial software,” said Tan Geok-Cheng, managing director, Synopsys Software Integrity Group.
Amongst the codebases audited for the 2020 OSSRA report, 75% contained at least one public vulnerability, an increase from the 60% of 2018, and an average of 82 vulnerabilities were identified per codebase. Similarly, the percentage of high-risk vulnerabilities increased to 49% in 2019, as opposed to 40% in 2018.
The Solution for FPT Software: Coverity SAST and Black Duck SCA
Coverity static application security testing (SAST), identifies critical software quality defects and security vulnerabilities to ensure code that is secure, higher-quality, and compliant with standards such as ISO-9001 and SEI CMMI Level 5.
Black Duck SCA provides FPT with a comprehensive solution for managing security, quality, and license compliance risk that comes from the use of open source and third-party code in applications and containers.
“Synopsys has surpassed our expectations in code scanning and security checking enhancement.” says Do Van Khac. “Coverity and Black Duck provide us with tools to significantly improve our software quality and customer satisfaction as well. Thanks to Coverity, we have achieved compliance with the security issues listed in the OWASP Top 10, demonstrating our capability to address the most critical security risks to web applications.”
The Results: Helping Developers Be More Productive
Synopsys Coverity and Black Duck are being used by FPT to manage an average 200 projects per year, integrating both AST tools into their Jenkins builds.
“Synopsys has solved a number of problems for us,” says Do Van Khac. “After adopting Coverity in 2015 and Black Duck in 2019 we are quite satisfied with Synopsys application security testing. Our evaluations indicate that Synopsys helps our developers be more productive by identifying relevant problems with fewer than 10% false positives or negatives. The tools’ rich reporting capabilities provide us with real-time insight into emerging trends so we can address problems sooner and minimise risk. We would strongly recommend the Synopsys AST tools to all enterprises, especially those specialising in Embedded Systems where code quality is of paramount importance.”
###
