Enhancing Code Quality and Security with Black Duck Application Security Testing Solutions
The Challenge
Improving the Quality and Security of Software Projects
FPT Software offers full lifecycle services for its customers, including software design, development, migration and modernization. Providing software components for clients’ systems often means working with legacy code and architectures not originally designed for modern interconnected environments. These must be stringently tested for the quality and security needed by today’s modern applications.
“Winning clients’ trust is our utmost priority, and we constantly focus on enhancing code security,” says Do Van Khac, Chief Delivery Officer and Executive Vice President at FPT Software. “We often encounter risks stemming from incompatible legacy code and architectures, which led to increased costs in remediation. We took the path of looking into tools to improve code quality and security as early as possible in the development lifecycle.”
The Delivery Command Center (DCC) at FPT performed a detailed evaluation of several static analysis solutions; ultimately determining that Coverity® Static Analysis (SAST) was the right choice for them. By helping to identify and fix software problems early in the development process, Coverity SAST not only accelerates FPT code reviews to improve code quality and security but also helps FPT reduce the need and cost of addressing those problems later.
With the growing use of open source components and libraries in software development, FPT customers requested that the company extend their software testing to include software composition analysis (SCA). FPT implemented Black Duck® SCA in 2019, and today FPT uses Coverity SAST and Black Duck SCA for virtually all their software project testing.
We took the path of looking into tools to improve code quality and security as early as possible in the development lifecycle."
Do Van Khac
|Chief Delivery Officer and Executive Vice President
The Solution for FPT Software
Coverity SAST and Black Duck SCA
Coverity SAST, identifies critical software quality defects and security vulnerabilities to ensure code that is secure, higher-quality, and compliant with standards such as ISO-9001 and SEI CMMI Level 5. Black Duck SCA provides FPT with a comprehensive solution for managing security, quality, and license compliance risk that comes from the use of open source and third-party code in applications and containers.
“Black Duck has surpassed our expectations in code scanning and security checking enhancement.” says Do Van Khac. “Coverity SAST and Black Duck SCA provide us with tools to significantly improve our software quality and customer satisfaction as well. Thanks to Coverity SAST, we have achieved compliance with the security issues listed in the OWASP Top 10, demonstrating our capability to address the most critical security risks to web applications.”
We would strongly recommend the Black Duck AST tools to all enterprises, especially those specializing in Embedded Systems where code quality is of paramount importance."
Do Van Khac
|Chief Delivery Officer and Executive Vice President
The Results
Helping Developers Be More Productive
Coverity SAST and Black Duck SCA are being used by FPT to manage an average 200 projects per year, integrating both AST tools into their Jenkins builds.
“Black Duck SCA has solved a number of problems for us,” says Do Van Khac. “After adopting Coverity SAST in 2015 and Black Duck SCA in 2019 we are quite satisfied with Black Duck application security testing. Our evaluations indicate that Black Duck helps our developers be more productive by identifying relevant problems with fewer than 10% false positives or negatives. The tools’ rich reporting capabilities provide us with real-time insight into emerging trends so we can address problems sooner and minimize risk.”
“We would strongly recommend the Black Duck AST tools to all enterprises, especially those specializing in Embedded Systems where code quality is of paramount importance.”
Company Overview
FPT Software is part of FPT Corporation, a technology and IT services provider headquartered in Vietnam with nearly USD $2 billion in revenue. A pioneer in digital transformation, FPT delivers world-class solutions services in smart factory technologies, digital platforms, robotic process automation, artificial intelligence, Internet of Things, mobility, cloud, managed services, testing, and more.