Product, service and DevOps security
Security of software products and IT services
To ensure the security of developed applications and services, including SaaS, we perform the following tasks:
- Identification and clarification of security requirements.
- Threat modeling and risk analysis.
- Development of security architecture of the IT system or solution.
- Implementation of secure coding. We help to implement security plugins DevSkim, JFrog Eclipse, Snyk, and others.
- Definition, development, and implementation of security measures and systems for all stages of the software life cycle or CI/CD phases. We help to implement Source Composition Analysis, secrets management tools, and security hooks like git-hound, git-secrets, and repo-supervisor.
- Automated and manual security review of the source code, including static, dynamic, and interactive security testing of applications (SAST, DAST, and IAST), and also Runtime application self-protection (RASP).
- Making sure that the systems are built, distributed, deployed, used, and disposed of securely. We help you to implement Secure Infrastructure as Code, Web Application Firewall, Monitoring tools, Chaos engineering tools. and Vulnerability management tools.
At each phase, its own set of deliverables (documents and other artifacts) is produced.
DevOps Security (DevSecOps)
If you require the highest quality and security for your software releases and operations at the maintenance stage, you should use our Security DevOps (also referred to as DevSecOps) services, which are much more secure than occasional penetration tests and which can be ordered as a monthly subscription:
|Quality and Security Gate|
This is a simplified Security DevOps service especially suitable for multiple products. The security checks can be done for monthly product releases, for instance. To estimate the man-hours for this service, we need you to provide the information about the technologies you use, the number of lines of source code, etc.
|Extended Security DevOps Service|
This service is intended for deep, comprehensive security testing and monitoring of your products. Especially if they are updated often. We can manage even daily updates. To estimate the man-hours for this service, we need you to provide the information about the technologies you use, the number of lines of source code, number of weekly or monthly changes, etc. See also Security experts as a service.
SOC (Security Operations Center). This service includes the implementation and/or maintenance of information security event monitoring and incident response processes and controls. We integrate security vulnerability and source code scanners into your infrastructure, configure round-the-clock scanning and security incident response procedures. On demand, we configure a Security Information and Event Management (SIEM) system for your environment. We have a positive experience of relatively quick implementation of and effective results from the customized solutions based on Syslog-ng, Graylog, Wazuh, OSSEC, ElasticSearch, Logstash, and Kibana. To estimate the man-hours for this service, we need the details about the infrastructure of your solution, services, API and support team. Learn more about SOC as a service and SOC implementation service.
See also our website security services.
To guarantee the best results, H-X strictly adheres to international standards, regulations, and best practices (e.g. OWASP, ISO 15408, ISO 27034, ISF SoGP, NIST 800-64, BSIMM, Payment Application Data Security Standard, Microsoft Security Development Lifecycle, and others).
Check out our additional services and business cases. Send the form below to order Security Product or DevOps services. Get a free consultation.