Contrast Security > Case Studies > Revolutionizing Application Security in Financial Services with IoT

Revolutionizing Application Security in Financial Services with IoT

Technology Category

Cybersecurity & Privacy - Application Security
Cybersecurity & Privacy - Network Security

Applicable Industries

Equipment & Machinery
National Security & Defense

Applicable Functions

Logistics & Transportation
Product Research & Development

Use Cases

Supply Chain Visibility
Tamper Detection

Services

Cybersecurity Services
Training

About The Customer

The customer is a global financial services firm that advises clients on a variety of matters, including regulatory issues, compliance, risk management, liquidity, restructuring, acquisitions, and more. The firm places a high priority on software application security, understanding that a data breach could expose customer data, result in potential financial losses for the company and its clients, and cause significant damage to the company’s reputation. The firm's development team had been using Contrast for over two years and had nearly eliminated vulnerabilities introduced in later stages of the software development lifecycle (SDLC).

The Challenge

The financial services firm in question was facing significant challenges in achieving comprehensive application security test coverage for its entire software portfolio. The existing application security tools were proving to be inaccurate and ineffective, leading to developer disengagement, product delays, and negative business impacts. The IT Security team was primarily focused on network security, relying on perimeter security solutions to protect their applications and data. The application development team had minimal involvement in application security, and the training they received did not keep pace with advances in application development and hacking. The security team lacked the visibility needed to work efficiently and effectively, with their scanner tool reporting many false positives and lacking the necessary information for developers to find and fix errors. The existing tools and processes were preventing a complete security analysis of their applications, delaying the delivery of new business-critical software functionality.

The Solution

The firm discovered Contrast Assess, a product that offered a unique approach to finding and presenting vulnerability data in a way that was understandable by both developers and the security team. Contrast Assess works from within the application, without requiring any configuration changes. Its quick and easy installation, detailed dashboard, and real-time, continuous approach solved many of the application security challenges the firm was facing. The firm decided to onboard the SaaS version of Contrast Assess to accelerate deployment and simplify ongoing operations. Using Contrast’s continuous security testing, the application development team improved the security of their applications and could provide predictable delivery without adding headcount or expertise to the team. Real-time results allowed developers to fix problems as they came up throughout the development process. The insight Contrast Assess provided into custom and third-party code helped the development team identify which libraries had vulnerabilities, and whether their firm’s applications were using vulnerable code within those libraries.

Operational Impact

The implementation of Contrast Assess has revolutionized the application security dynamics at the company. The application development manager now keeps the entire development team informed and in control of his applications’ security status by using the visibility provided by Contrast. Access to detailed, actionable information – where vulnerabilities come from, why they are important, and how to fix them – keeps his team at the forefront of security. They are no longer consumers, but owners of their applications’ security. The development team now has the visibility and control they need to be security-focused, accurate, and self-sufficient. Application security is now an integral and unobtrusive part of the software development lifecycle.

Quantitative Benefit

Vulnerability resolution time reduced from weeks and months to just a few hours.
Nearly eliminated vulnerabilities introduced in later stages of the SDLC.
Improved security of applications without adding headcount or expertise to the team.