Applied solution submits own and third party systems to source code analysis for vulnerability detection; teams gained productivity after applications passed targeted corrections

Comprised of a wide variety of systems to serve various internal and external processes, Sabesp currently serves 367 municipalities in the State of São Paulo, benefits more than 27.7 million people with water supply and more than 21.4 million users with sewage collection. To protect the system from vulnerabilities and security flaws in software applications, the company announces the contracting of managed services from Nalbatech. The project is supported in the use of the bugScout platform.

“With managed services for application security, we increase the efficiency of our work, allowing us to comply with the company’s Information Security Master Plan,” says Daniel Bocalão, manager of the Information Security and Connectivity Department – (CIC) at Sabesp. The executive is responsible for the security of the corporate network, systems and services and information vital to the company’s business processes.

In internal systems development, NalbaTech monitors and supports the use of the bugScout solution, which detects security risks during the life cycle of software applications. When third parties, the company performs the analysis of source code to detect possible flaws and subsequent correction by the manufacturer. “The work is done by sampling, to reduce time and investment, and later on throughout the application. Suppliers are informed about the tests even before hiring and are then instructed to make the necessary corrections. The analysis of the entire source code of the application follows the pattern of use of these systems within the company ”, explains Bocalão.

In the field, the Internet of Things is already applied in devices and systems that collect in real time the data on water and sewage services delivered to the population, and which involves the identification of consumption, changes or deviations in the consumption pattern, potential for leakage , among many other variants, producing a large amount of data that needs to be protected. This account also includes administrative management, billing, CRM, asset control, supplies, HR and other systems, which pass the vulnerability tests required by the company.

The most found vulnerabilities

More than a thousand applications have already been analyzed, and the most common flaws in third-party applications are related to the exposure of sensitive information, weak encryption, violation of trust limits, basic errors in the source code, among others. “There is rarely any application on the market without finding a fault,” says Bocalão.

Increased user productivity

Security vulnerabilities are not the only ones identified. With errors in the source code, many systems become slow, significantly impacting the productivity of networks and teams. “We noticed a very big increase in productivity after the applications went through the corrections guided by bugScout”, says Bocalão. “With the maturity in the use of the solution, we also improved our internal processes and procedures”.

Nalbatech, a company of the Nfq Group, specialized in consulting and professional services for banks, capital markets and insurance, announces the acquisition of the bugScout platform, created by the Spanish Buguroo Offensive Security, of which it has been a partner for more than 4 years for offering, implementing and supporting the security risk detection solution throughout the life cycle of software applications.

bugScout is a robust, state-of-the-art source code analyzer used by companies from various segments in their software projects and also in the security validation of third-party applications at the time of contracting. With the acquisition of bugScout, Nalbatech strengthens its portfolio of Information Security, Governance and Compliance and Software Quality technologies and services.

Francisco Bernabeu, director of Nalbatech, says that since 2013 the company has been offering managed services based on bugScout and the decision to purchase the definitive rights to the tool “strengthens its position as a key supplier of managed security and software quality services, since the company becomes the owner and developer of the platform, and is also responsible for its evolution and technological improvement ”.

The executive also states that, with acquisition, Nalbatech achieves a strategic position in a market where all systems face some type of vulnerability at some stage of its life cycle. “In practice – companies suffer from high security weaknesses and the real possibility of data loss or cyber attacks on corporate networks. In addition, investments in fixing vulnerabilities are on average three or four times greater than development itself. With bugScout right at the beginning of the software project, this time and investments can be 90% less considering the current expenditure, in addition to avoiding incalculable losses in the event of an attack ”, highlights Bernabeu.

bugScout is compatible with the languages most used in web and mobile environments and includes complete frameworks for each development environment, covering the most complex flows, such as dependency injection, ORMs or databases unrelated to others. The platform assists in building secure applications based on the analysis of all vulnerabilities identified in all reference standards, such as OWASP, WASC or CWE.

“The solution has a high capacity for observing source codes and minimizes the risk exposure of companies and users, making the developed software stronger and more robust against threats, both in the corporate internal environment and on mobile”, emphasizes Francisco Bernabeu.

More information: https://nalbatech.com

Nalbatech has a marked presence at CNASI 2017, the largest ICT Information Security, Audit and Governance Congress – 26th edition. The event took place on September 25 and 26 www.cnasi.com.br.

Nalbatech stood out with its exclusive partnership with BUGUROO.

For more than 15 years in the market, BUGUROO creates cutting edge solutions in the scope of cybersecurity thanks to the innovative vision of a young team with great talent.

Our cybersecurity tools are divided into two main areas: Online Fraud Prevention is Vulnerability Analysis in the Code.

bugFraud Defense, an online fraud solution that uses Deep learning and biometric analysis of users to detect and prevent threats to users of digital banking.

bugScout, a state-of-the-art source code analyzer that combines quality and security analysis to have the most complete risk detection associated with your source codes.

At the last event, Nalbatech, took ASUG members some of the facilities of the tool focusing on the application of eSocial. Follow the link below for a simple demonstration of extraction and loading of massive data. In this example, the correction of some fields in infotype 0006 is used regarding the address register in SAP’s PA30 transaction in the HCM module, however, depending on demand, we can perform Robotic Process Automation (RPA) of different types of transactions, infotypes and analysis of data:

Innowera Process Runner dramatically reduces ongoing costs. It allows SAP users to automatically maintain and migrate data daily to their SAP systems without having to write a program. Use multiple data sources, such as Microsoft Excel, SQL, Oracle, Sybase, DB2, Access, SharePoint, etc. to perform the drag and drop operation between these sources and your SAP system.
Here are the 5 ways Innowera has found to make SAP easier:
1 – Run SAP Excel
2 – Run SAP directly from your email
3 – Manage Server-Based Excel Workflows
4 – Don’t stick to a desk / DeskTop
5 – Use the WEB