How & Why:

Application Security Testing in Developer Workflows

Why include AST (Application Security Testing) in your developer workflow?


  • Early Defect Detection: AST allows you to identify security flaws early in the development cycle, making them easier and cheaper to fix. This is achieved by scanning code directly within Integrated Development Environments (IDEs), Source Control Management (SCM) tools, and Continuous Integration/Continuous Delivery (CI/CD) pipelines. (Integrate with Veracode)


  • Streamlined Remediation: By providing specific line-of-code findings and remediation guidance directly within the developer's environment, Veracode integrations help streamline the defect triage and fixing process.


  • Automation: Veracode's APIs and plugins automate various security testing tasks, such as creating application profiles, uploading applications for scanning, and importing findings into issue tracking systems. This automation helps maintain security throughout the Software Development Life Cycle (SDLC).


  • Policy Enforcement: Integrating AST into CI/CD pipelines allows you to enforce security policies by automatically stopping the build or release process if security issues are found that violate these policies.


  • Compliance and Reporting: Integrations can generate reports on security findings, helping organizations meet their Governance, Risk, and Compliance (GRC) obligations. 

 

What does this unlock for me & my team?



  • Identify and Fix Flaws Directly in Your IDE: You can scan your code, review security findings, and even apply suggested fixes directly within your Integrated Development Environment (IDE) like Visual Studio, VS Code, Eclipse, or JetBrains IDEs. This means less context switching and a more streamlined development process. (Scan for Visual Studio, Scan for VS Code, Scan for Eclipse, Scan for JetBrains)


  • Faster Remediation: By getting security feedback early and directly in your workflow, you can identify and fix vulnerabilities much faster, reducing the time and effort required for remediation.


  • Improved Developer Productivity: Automating security checks and providing clear remediation guidance within the IDE helps developers become more efficient and focus on writing secure code without extensive context switching.


  • Early Detection of Vulnerabilities: Integrating Software Composition Analysis (SCA) into your workflow allows you to identify risks associated with open-source libraries early, preventing potential vulnerabilities from making it into production

.

  • Centralized Security Management: Integrations can help automate the process of importing security findings into issue-tracking systems, providing a more centralized view of security status and facilitating better collaboration between development and security teams.


How: Paths to Success


Seamless Integration into IDEs:

  • Choose the Right Plugin: Veracode offers plugins for popular IDEs like Visual Studio, VS Code, Eclipse, and JetBrains IDEs. Select the plugin that matches your team's development environment. (Veracode Integrations)
  • Proper Authentication: Ensure you configure authentication correctly, either through SSO (recommended) or API credentials. This allows the IDE plugins to securely connect to the Veracode platform.
  • Install Local Agent: The IDE plugins often require a local agent for tasks like autopackaging and communication with Veracode. Ensure this is installed correctly. (Scan for Visual Studio, Scan for VS Code, Scan for Eclipse, Scan for JetBrains)



Efficient Scanning and Remediation:


  • Scan Early and Often: Encourage developers to scan their code frequently, ideally before committing changes. This allows for early detection of vulnerabilities.
  • Utilize Veracode Fix: When available, use Veracode Fix suggestions within the IDE to automatically apply recommended code changes for vulnerabilities. This significantly speeds up the remediation process.
  • Leverage Consultation Calls: Call Veracode’s team of experience consultants who can help diagnose any issues, understand Veracode’s findings, and help you with a fix. (How to Schedule a Consultation Call)
  • Filter and Prioritize: Use the filtering capabilities within the IDE plugins to focus on the most critical vulnerabilities (e.g., by severity) or those with available fixes. (Scan for Visual Studio, Scan for VS Code, Scan for Eclipse, Scan for JetBrains)


Continuous Improvement:

  • Manage Open Source Security: Utilize the SCA capabilities within the IDE plugins to identify and address vulnerabilities in open-source libraries, including reviewing license risks.


  • Troubleshooting: Familiarize yourself with common troubleshooting steps for API and plugin issues, such as authentication problems or scan failures, to quickly resolve any integration challenges. (Troubleshoot errors)






Guide Links: