DevOps - ValueLabs

End-to-End Case Study

Geo location

US (Central)

Platform

Web & Mobile

Engagement

8 Years

Industry

Travel

Service

DevSecOps & SRE

Challenges

Despite rolling out 15-20 major releases every two weeks, the client’s security assessment was manual and occurred in a siloed manner after the development process concluded. Assessments were also conducted independently of each other, making it difficult to gather key insights. Moreover, it was tough for anyone other than test engineers to run tests or analyze the results.

Manual interventions caused bottlenecks

Isolated processes prevented insights

Lack of CI/CD pipeline integration

Loss of efficiency and accuracy

Our client rolled out 15-20 major releases every two weeks
The security assessment process was manual
The process was not integrated into the CI/CD pipeline
The assessments were also conducted in isolation and didn’t allow for broad-picture insights

Our Solution

Our client wanted to see exactly what software quality engineering in the airline industry could do. We understood the need to integrate quality software testing into the CI/CD pipeline to speed things up and gain insights across the testing process. Our software testing services team embedded a DevSecOps solution and a centralized platform for all tests, bringing security test automation into the CI/CD pipeline.

Solution Impact

1 Day

Reduction in release cycle time

Using a test automation framework

Enabled faster vulnerability identification and remediation

Integrating testing into the development pipeline

Improved release cycle time, integrated processes, and reduced infrastructure costs for security testing

Our Approach

We quickly realized that the client needed to introduce DevSecOps as a service into the entire development process. We introduced a CI/CD workflow that featured Static Application Security Tests (SAST) for code scanning at the CI stage and applied Dynamic Application Security Tests (DAST) for application scanning at the CD stage. We built a centralized platform using DefectDojo, to which the code scan results could be pushed. This created a single source of truth for assessing all vulnerabilities, resulting in a more comprehensive view of test results.

Top DevOps Mistakes to Avoid

Read Blog

Brought in DevSecOps automation to integrate assessments

Focusing on application security was one of the major concerns of our client. While the airline conducted vulnerability testing for new software releases, it was done manually after the DevOps workflow. That meant that testing increased the delivery lifecycle, and there was no overall visibility of the security testing results. Vulnerabilities, if any, were picked up relatively late, further delaying releases and increasing manual rework.

To integrate software testing services for the airline, we introduced a DevSecOps automation strategy, so product assessments could be conducted during design and development in the CI/CD pipeline. We began with a Static Application Security Test (SAST) for code scanning and a Dynamic Applications Security Test (DAST) for app scanning. We also brought in a process to onboard apps into this pipeline.

Tech Stack

Built a centralized platform to improve security scans

The lack of security assessment systems was a drawback for the client, as they failed to get an overview of how the apps performed. We built a dashboard using DefectDojo that would allow testers and those with security clearance to get an overview of the apps’ performance to take big-picture decisions. This created a single source of insight for assessing all the vulnerabilities across all apps, and every security scan was tracked in the app, allowing unprecedented oversight.

By proposing a more efficient approach to security testing, we enabled cost and time efficiency for the client – as well as significantly reduced the risk of any vulnerabilities making it into production applications.

Built a centralized platform to improve security scans

Business Impact

We folded assessments into the development process instead of being a separate task after development, and our dashboard enabled the client to identify and rectify vulnerabilities at a faster rate. Our DevSecOps solution shortened the release cycles, saved the developers’ and testers’ time, and provided for early identification and remodification of the vulnerabilities.