Applied solution submits own and third party systems to source code analysis for vulnerability detection; teams gained productivity after applications passed targeted corrections

Comprised of a wide variety of systems to serve various internal and external processes, Sabesp currently serves 367 municipalities in the State of São Paulo, benefits more than 27.7 million people with water supply and more than 21.4 million users with sewage collection. To protect the system from vulnerabilities and security flaws in software applications, the company announces the contracting of managed services from Nalbatech. The project is supported in the use of the bugScout platform.

“With managed services for application security, we increase the efficiency of our work, allowing us to comply with the company’s Information Security Master Plan,” says Daniel Bocalão, manager of the Information Security and Connectivity Department – (CIC) at Sabesp. The executive is responsible for the security of the corporate network, systems and services and information vital to the company’s business processes.

In internal systems development, NalbaTech monitors and supports the use of the bugScout solution, which detects security risks during the life cycle of software applications. When third parties, the company performs the analysis of source code to detect possible flaws and subsequent correction by the manufacturer. “The work is done by sampling, to reduce time and investment, and later on throughout the application. Suppliers are informed about the tests even before hiring and are then instructed to make the necessary corrections. The analysis of the entire source code of the application follows the pattern of use of these systems within the company ”, explains Bocalão.

In the field, the Internet of Things is already applied in devices and systems that collect in real time the data on water and sewage services delivered to the population, and which involves the identification of consumption, changes or deviations in the consumption pattern, potential for leakage , among many other variants, producing a large amount of data that needs to be protected. This account also includes administrative management, billing, CRM, asset control, supplies, HR and other systems, which pass the vulnerability tests required by the company.

The most found vulnerabilities

More than a thousand applications have already been analyzed, and the most common flaws in third-party applications are related to the exposure of sensitive information, weak encryption, violation of trust limits, basic errors in the source code, among others. “There is rarely any application on the market without finding a fault,” says Bocalão.

Increased user productivity

Security vulnerabilities are not the only ones identified. With errors in the source code, many systems become slow, significantly impacting the productivity of networks and teams. “We noticed a very big increase in productivity after the applications went through the corrections guided by bugScout”, says Bocalão. “With the maturity in the use of the solution, we also improved our internal processes and procedures”.

Nalbatech, a company of the Nfq Group, specialized in consulting and professional services for banks, capital markets and insurance, announces the acquisition of the bugScout platform, created by the Spanish Buguroo Offensive Security, of which it has been a partner for more than 4 years for offering, implementing and supporting the security risk detection solution throughout the life cycle of software applications.

bugScout is a robust, state-of-the-art source code analyzer used by companies from various segments in their software projects and also in the security validation of third-party applications at the time of contracting. With the acquisition of bugScout, Nalbatech strengthens its portfolio of Information Security, Governance and Compliance and Software Quality technologies and services.

Francisco Bernabeu, director of Nalbatech, says that since 2013 the company has been offering managed services based on bugScout and the decision to purchase the definitive rights to the tool “strengthens its position as a key supplier of managed security and software quality services, since the company becomes the owner and developer of the platform, and is also responsible for its evolution and technological improvement ”.

The executive also states that, with acquisition, Nalbatech achieves a strategic position in a market where all systems face some type of vulnerability at some stage of its life cycle. “In practice – companies suffer from high security weaknesses and the real possibility of data loss or cyber attacks on corporate networks. In addition, investments in fixing vulnerabilities are on average three or four times greater than development itself. With bugScout right at the beginning of the software project, this time and investments can be 90% less considering the current expenditure, in addition to avoiding incalculable losses in the event of an attack ”, highlights Bernabeu.

bugScout is compatible with the languages most used in web and mobile environments and includes complete frameworks for each development environment, covering the most complex flows, such as dependency injection, ORMs or databases unrelated to others. The platform assists in building secure applications based on the analysis of all vulnerabilities identified in all reference standards, such as OWASP, WASC or CWE.

“The solution has a high capacity for observing source codes and minimizes the risk exposure of companies and users, making the developed software stronger and more robust against threats, both in the corporate internal environment and on mobile”, emphasizes Francisco Bernabeu.

More information: https://nalbatech.com

At the last event, Nalbatech, took ASUG members some of the facilities of the tool focusing on the application of eSocial. Follow the link below for a simple demonstration of extraction and loading of massive data. In this example, the correction of some fields in infotype 0006 is used regarding the address register in SAP’s PA30 transaction in the HCM module, however, depending on demand, we can perform Robotic Process Automation (RPA) of different types of transactions, infotypes and analysis of data:

Innowera Process Runner dramatically reduces ongoing costs. It allows SAP users to automatically maintain and migrate data daily to their SAP systems without having to write a program. Use multiple data sources, such as Microsoft Excel, SQL, Oracle, Sybase, DB2, Access, SharePoint, etc. to perform the drag and drop operation between these sources and your SAP system.
Here are the 5 ways Innowera has found to make SAP easier:
1 – Run SAP Excel
2 – Run SAP directly from your email
3 – Manage Server-Based Excel Workflows
4 – Don’t stick to a desk / DeskTop
5 – Use the WEB

TmaxSoft, a Korean multinational company providing software for IT infrastructure, and Nalbatech, a Spanish multinational company providing IT solutions, announce the renewal of their contract with Sabesp.

As a result of bidding, the negotiation enables the supply of Tibero, TmaxSoft’s database, with the objective of supporting the applications of the legacy environment and the migration of new applications to this environment. Sabesp contracted Tibero Enterprise Edition 6.0 and Tibero Active Cluster (TAC) licenses. The investment in the technological solution in 2016 was over R $ 2.3 million and for 2017 the value is R $ 3.3 million.

Developed internally by Sabesp’s Collection Department, the SIC system started operating in 2000, based on a database that, until then, had met the company’s demands. Over the years, new features needed to be included, which required the evolution of the adopted solution that no longer supported them. Even because it is an old version, the database no longer had the technical support of the manufacturer, a feature that represents a great risk for the company.

Sabesp decided to start a bidding process for the migration of the environment and, in 2016, the company opted to update the database by opening a bidding process which Tibero won. After one year of using the TmaxSoft database TmaxSoft, Sabesp identified the success and stability of the SIC, as there was no impact whatsoever, which provided a security environment to be able to migrate other applications.

Taking into account this positive scenario with the acquisition of the TmaxSoft solution, after one year, Sabespdecided to migrate more systems and increase the Tiberoenvironment by hiring new licenses. In fact, the company opted for a high availability environment when using the Tibero Active Cluster (TAC), which provides business continuity without risks and with high performance.

The solution hired by Sabesp is a new database option for the Brazilian market, as it has local support, integration with other suppliers’ versions, lower cost and quick migration.

Nalbatech, TmaxSoft do Brasil’s business partner, was the winner of Sabesp’s bidding process and was responsible for supplying licenses, implementing and supporting the Tibero project on the company’s systems.

Nalbatech carried out the total migration of data to Tibero in just 1h30, without risks or major changes in the codes and with the SIC running at full performance.

In addition to enabling the evolution of the system and having the technical support sought by the company, the solution offers the possibility of simplified and accessible virtualization, another objective of the Sabesp team. The solution allows virtual environment licensing without the need for physical environment licensing,which reduces costs, since there is no need to invest in hardware and new licenses. This is a differential of TmaxSoft compared to other options on the market. In short, the adoption of Tibero brings several benefits such as:

• Support the maintenance of the proposed environment,
• Modernization of the current, increased availability,
• Database compatibility with the application,
• Systemic evolution,
• Reliability of the environment and functioning of migrated applications,
• Data migration with security and in an integral and
• Implementation of the monitoring tool (considering alerts and preventive actions for environmental management).