Strengthening Security through the Secure Software Development Lifecycle
For Thermo Fisher Scientific, we set up a security-oriented environment for web application development in line with corporate standards. The project strengthened security controls across the entire development process.
Customer
Competences
Technology
About the Case Study _
Benefits for the customer:
- Reduced time requirements for the customer by delegating the analytical part of the project to Edhouse,
- The acquired know-how is now applied in other projects we deliver for the customer.
For our long-standing customer Thermo Fisher Scientific, we actively participated in setting up a security-oriented environment for the development of web and other applications. We were involved in assessing vulnerabilities in both the application and the development toolchain.
At Edhouse, we performed a security audit of the SW Library application. This web application is used to manage software packages and has been developed long-term by the Edhouse team.
The first step was to analyze the current state and configuration of the source code management platform (GitLab). Based on the analysis, we decided to use the GitHub platform, which provides advanced security features.
We reviewed the application development and deployment process, looked into user management, and set up and evaluated the outputs of source code analysis using CodeQL. We activated secret scanning and Dependabot. This was followed by the automatic generation of an SBOM document to describe the application components in the internationally supported CycloneDX format. The platform now alerts developers when they use an internal or external component without specifying its license and thus its origin. After documenting the components, cryptographic algorithms, and static analysis (SAST) outputs, we performed a dynamic analysis (DAST), using the comprehensive capabilities of the Qualys platform.
The development team received the results of static and dynamic code analysis and recommendations for corrective actions in a format that complies with the customer's internal standards. Corrective actions will be gradually incorporated into subsequent stages of product development. Automatic static and dynamic analysis will ensure continuous source code security checks now and in the future.
Throughout the project, we consulted the solution with security experts from the Thermo Fisher Corporate Infrastructure & Security team. This collaboration further strengthened our partnership and deepened our expertise in delivering CyberSec projects.
