What To Know
- Complete and thorough security testing is essential for risk management in the later stages of the software development lifecycle (SDLC), but it is often impractical to perform full scans at each incremental step in the early stages of the SDLC due to the time and resources required.
- Intelligent Orchestration, which enables DevOps teams to run the right security tests at the right time, can leverage Rapid Scan at early stages in the pipeline when speed and efficiency are critical, and it can run full Coverity and Black Duck scans at later stages in the pipeline when validating the quality and security of applications prior to deployment.
Editor’s brief: It is a march of speed, agility, performance, and security, when it comes to software development. Most entities today design and deploy code at a speed to outpace their competition, with a fast accelerating need to bring cybersecurity into parity with speed to market as well. Synopsys, the leader in software integrity, announces that its Coverity static application security testing (SAST) and its Black Duck software composition analysis (SCA) solutions are now equipped with Rapid Scan capabilities, providing fast and lightweight vulnerability detection for any entity’s proprietary as well as open source code used in such applications. Read more below.
SINGAPORE – Synopsys, Inc. (Nasdaq: SNPS) today announced the availability of new Rapid Scan capabilities within the company’s Coverity static application security testing (SAST) and Black Duck software composition analysis (SCA) solutions. The Rapid Scan features provide fast, lightweight vulnerability detection for both proprietary and open source code. Rapid Scan is optimised for the early stages of development, particularly for cloud-native applications and infrastructure-as-code (IaC).
Complete and thorough security testing is essential for risk management in the later stages of the software development lifecycle (SDLC), but it is often impractical to perform full scans at each incremental step in the early stages of the SDLC due to the time and resources required. With Rapid Scan, development teams can quickly and efficiently perform SAST and SCA scans at every code check-in or early-stage build, enhancing the effectiveness of traditional application security testing activities. As a result, developers are able to shift left more effectively, and security issues are less likely to be passed along to subsequent SDLC phases.
“One of the hallmarks of modern software development is breaking down large processes into smaller, more manageable tasks that can performed rapidly and concurrently in a distributed fashion,” said Jason Schmitt, general manager of the Synopsys Software Integrity Group. “For organisations embracing DevSecOps, application security testing needs to follow suit. With Rapid Scan, Coverity and Black Duck users can run quick preventative scans to detect and eliminate surface-level vulnerabilities as their developers write and commit code, and they can use the same solutions to run deep scans later in the SDLC prior to deploying their applications.”
The new capabilities include:
Coverity Rapid Scan. The new Rapid Scan capabilities of Coverity SAST provide fast security analysis of proprietary code at the developer’s desktop and in continuous integration (CI) pipelines such as GitLab and GitHub Actions. Coverity Rapid Scan is optimised for cloud-native applications built on infrastructure-as-code frameworks such as Kubernetes, Terraform, and CloudFormation, and micro-services such as GraphQL, Kafka, and Postman. Rapid Scan can quickly detect many of the most common security weaknesses, as well as problematic misconfiguration flaws and API misuses.
Black Duck Rapid Scan. The Rapid Scan capabilities of Black Duck SCA allows developers and release managers to perform fast dependency analysis to determine if any of the open source components in their application violate their organisation’s security and license policies prior to merging code into release branches. Black Duck Rapid Scan is optimised for speed and efficiency by providing developers with early insight into dependency risk and by deferring resource-intensive SCA activities such as multi-factor open source detection and generating a complete software bill of materials to later stages of the SDLC.
Intelligent Orchestration and Rapid Scan. The Coverity and Black Duck Rapid Scan capabilities can be used in conjunction with Synopsys’ Intelligent Orchestration solutionto automatically trigger fast SAST and SCA scans based on events in the continuous integration (CI) pipeline. Intelligent Orchestration, which enables DevOps teams to run the right security tests at the right time, can leverage Rapid Scan at early stages in the pipeline when speed and efficiency are critical, and it can run full Coverity and Black Duck scans at later stages in the pipeline when validating the quality and security of applications prior to deployment.
###
