DEVOPSdigest

Veracode announced innovations to help developers build secure-by-design software, and security teams reduce risk across their code-to-cloud ecosystem.

The latest enhancements in Veracode Fix and Veracode Risk Manager, formerly known as Longbow Security, give developers the ability to build software, assess risk, and remediate at the click of a button in their preferred environment.

Tim Jarrett, Group Vice President of Product Management at Veracode, said, “Six months ago, we proudly signed the Cybersecurity and Infrastructure Security Agency’s (CISA) Secure By Design pledge, which set out to build cybersecurity into the design and manufacture of technology products. To fulfil that promise, Veracode continues to invest in new features that shift security left and make it a more automated, frictionless experience for developers.”

The latest innovations in Veracode Fix, which combines AI and human expertise to reduce remediation time from months to minutes, means developers now have access to drop-in code fixes for up to 80 percent of first-party weaknesses. For an organization with 2,000 security flaws, this means using the tool could cut the time to clear security debt by 2,400 hours, saving $240,000 compared to manual remediation.

“We listened carefully to feedback from developers who loved the tool and wanted to integrate it into their workflows. With many of our customers building in environments like GitHub every day, we brought Veracode Fix directly into their Push/Pull Request activities. Our flexible GitHub Action can be configured to remediate all files in a project, fix all supported flaw types, and enable developers to leave individual comments on each fix suggestion,” Jarrett said.

Veracode Fix is available in all integrated development environments (IDE), meaning developers can fix vulnerabilities at the push of a button in their CI/CD pipelines and ensure they’re building software that’s secure by design.

With Veracode’s newest IDE support, developers can also find and fix vulnerabilities in first-party and open-source code before adding it to the codebase. This means more streamlined workflows and problem-solving using static analysis and software composition analysis in Visual Code Studio, JetBrains (IntelliJ, PyCharm, Rider), Eclipse, and Visual Studio.

Alongside Veracode Fix, Veracode Risk Manager (VRM) correlates and contextualises risk from code to cloud, tracing it back to the root cause to enable one-to-many remediation. This comprehensive visibility empowers security teams to prioritize and eliminate the most critical vulnerabilities with the least amount of effort.

A series of new advancements to VRM gives developers and security teams even greater control over risk management. The latest features include:

- GitLab Repository Connector: Empowers root cause analysis of runtime issues by tracing them directly back to the source code repository, allowing teams to pinpoint the origin of risks and accelerate remediation.

- GitLab Ultimate Security Findings: Enables ingestion, unification, correlation, and prioritization of Gitlab Ultimate Security Findings including Static Analysis and Container Security findings. This enables teams to focus on the issues that matter most and provides unified risk and compliance reporting.

- Custom Compliance Mappings: Provides organizations with the tools to customize compliance mappings according to their specific requirements, facilitating easier compliance management.

- New Connectors: VRM has several new native findings connectors, including Tenable, Qualys, Rapid7, Aquasec, ServiceNow Two-Way sync, and more.

“VRM is the brain of cloud-native security, making it an indispensable tool for enterprises committed to fortifying their defenses in a cloud-native world. The tool addresses common challenges, such as fragmented visibility and scalability limitations, and transforms how organizations visualize, prioritize, and remediate risk with a 360-degree view of security vulnerabilities. These latest enhancements, along with the Application Risk Heatmap and Universal Connector features we launched earlier this year, make VRM a transformative upgrade for enterprises that are serious about security,” Jarrett said.

Veracode’s newly appointed Chief Product Officer, Ravi Iyer, is focused on embedding security into product development and enhancing the overall developer experience. “These latest innovations underline the importance of building, buying, and deploying software that’s secure by design. Our customers need solutions that help them identify, manage, and remediate risk at scale, and we’ll continue to meet this demand by making Veracode’s products integrated and easy for developers to use,” Iyer said.