Group 25 Created with Sketch.

To delivering secure apps.

Stay out of headlines. Discover how to automate security testing, and ensure every bit of code is scanned before it leaves the developer’s hands.

Learn how
Integrated security Real life stories Continuous security testing with GitLab A single solution Dive deeper

INTEGRATED SECURITY

Lean into DevSecOps. Commit to better business velocity.

When security testing is separate from the development process, it slows down the velocity and blocks application delivery. By the time the resource-constrained security team to run the scans, developers have already moved into another project and have to spend significant time understanding the context of the vulnerability. As a result, business improvements take a back seat.

Balancing business velocity with security is possible. When application security is a natural byproduct of the development workflow, every piece of code is tested upon commit, developers can remediate in real-time, security teams focus on the high priority vulnerabilities, and third party code is identifiable.

Suddenly, speed and security aren’t at odds with each other. You’re able to increase velocity, reduce cycle time, minimize risk, and deliver greater business agility without needing to make harmful tradeoffs.

Group Created with Sketch.

A Seismic Shift in Application Security

Download the whitepaper now to find out how to integrate and automate security in the DevOps lifecycle.

Download the whitepaper
Group 26 Created with Sketch.
divider Created with Sketch.

Just commit to integrated security testing.

With application security embedded into the development workflow, security bugs are found earlier, clearing noise for the security analysts and, ultimately, increasing time to market.

Vulnerabilities are often discovered in production, caught just before go-live, causing project delays. But, with application security baked into the CI/CD process, every merge request is scanned for vulnerabilities in the code and its dependencies. Developers are able take action without waiting for security and learn from common mistakes, allowing security teams to focus on anomalies and exceptions. As a result, less time is spent on remediating security flaws and security is no longer a blocker to application delivery.

Just commit to reducing technical debt.

The use of third-party code is exploding: The percentage of open source code within a codebase has grown 21% in just one year*. As more third-party code is introduced, usage increases, and risk compounds. Not catching a dependency vulnerability in real-time can cause major setbacks later.

However, when built into the CI/CD pipeline, a dependency scanner can analyze external dependencies (e.g. Ruby gem libraries) for known vulnerabilities on each code commit. Imagine that as a developer is coding, they are getting notifications, in real-time, when a dependency is vulnerable, and a link to patch it immediately.

96%

of applications contain open source components*

57%

of a codebase is open source code, on average.*

78%

of codebases examined contained at least one vulnerability*

*Source: Black Duck’s 2018 Open Source Security and Risk Analysis report.

Just commit container security.

Containers are a great solution for making applications transportable and reducing infrastructure configuration overhead or vendor lock-in. However, they also introduce an entirely new surface that is vulnerable to attacks. Automotive company, Tesla, discovered this the hard way last year when a Kubernetes container that had been left without password protection was discovered and attacked by a hacker.

Thankfully, container scanning can be integrated directly into the development workflow so developers can be alerted of container vulnerabilities before code is deployed to production.

divider Created with Sketch.

REAL LIFE STORIES

How Wag! cut their release process from 40 minutes to just 6

Read more

Equinix increases the agility of their DevOps teams with self-serviceability and automation

Read more

divider Created with Sketch.
line-animation Created with Sketch.

Suddenly, speed and security aren’t at odds with each other. You’re able to increase velocity, reduce cycle time, minimize risk, and deliver greater business agility without needing to make harmful tradeoffs.

divider Created with Sketch.

SECURE & DEFEND WITH GITLAB

Get integrated security out-of-the-box with a single application for the entire DevOps lifecycle.

GitLab’s continuous security testing capabilities support decision makers. Instead of security being a blocker, application security testing is integrated into the continuous integration and delivery process, so every piece of code is automatically tested upon commit, without incremental cost.

Group 15 Created with Sketch.

Commit to greater efficiency

Balancing business velocity with security is possible. When application security is a natural byproduct of the development workflow, every piece of code is tested upon commit, developers can remediate in real-time, security teams focus on the high priority vulnerabilities, and third party code is identifiable.

Group 16 Created with Sketch.

Commit to simplicity

GitLab’s single application embeds security testing into developers’ natural workflow with understandable results reported to the developer, including remediation advice and line-of-code detail, enabling them to remove the vulnerability before their code is merged with other code.

Group 16 Copy Created with Sketch.

Commit to compliance

Help your teams achieve and demonstrate compliance with controls built-in to to the workflow. Instead of treating compliance like a cumbersome afterthought, rest easy knowing that auditing, logging, traceability, and reporting are built-in.

divider Created with Sketch.

A SINGLE SOLUTION

Security workflow for developers

Developers have a front-row view of security with features baked into the merge request pipeline. GitLab’s integrated static application security testing (SAST) scans to spot potential vulnerabilities before deployment; dynamic application security testing (DAST) runs live attacks against the automatically provided review app. All vulnerabilities are shown in-line with the affected code for easy remediation.

Learn more
security-scanning Created with Sketch.
security-visibility Created with Sketch.

Visibility into third party code and containers

Dependency scanning and container scanning is built-in to GitLab’s CI/CD pipelines. Automatically analyze external dependencies for known vulnerabilities, check application environments, and check license compliance with every commit—without any additional set up.

Learn more

High-level view of overall risk from applications

GitLab’s Security Dashboard gives security professionals a single view of the status of each branch by aggregating vulnerabilities found in each merge request. This view gives security teams a high-level view so they can easily take action on the highest-priority issues.

Learn more
security-risk Created with Sketch.
divider Created with Sketch.

Get in touch

Want to learn more about how GitLab can help you deliver secure applications without sacrificing business velocity? Let’s talk.

Contact sales
divider Created with Sketch.

DIVE DEEPER

A seismic shift in application security

What is continuous security testing?

Building compliant applications

PCI compliance with GitLab

Financial services regulatory compliance with GitLab

HIPAA compliance with GitLab
Edit this page — open Web IDE — please contribute. Creative Commons License