What is our primary use case?
We use Veracode primarily for three purposes:
- Static Analysis, which is integrated into our CI/CD pipeline, using APIs.
- Every release gets certified for a static code analysis and dynamic code analysis. There is a UAT server, where it gets deployed with the latest release, then we perform the dynamic code scanning on that particular URL.
- Software Composition Analysis: We use this periodically to understand the software composition from an open source licensing and open source component vulnerability perspective.
How has it helped my organization?
For the issues that are being reported by Veracode, normally we collect those issues, and at least once a quarter, we have an awareness session with the developer. We then explain that what is the vulnerable pattern that has been caught and how to avoid it in the future, so they will not introduce it in the first place.
The main benefit of Veracode is it can give you a report in various formats, e.g., PCI compliant. That is very helpful for us. It gives our customers confidence because they trust Veracode. When we submit a report generated by Veracode, they accept it. We have seen in the past that this has helped us during the pre-sales cycle, and from that aspect, it is pretty powerful.
The centralized view of different testing types helps reduce our risk exposure. The development teams have the freedom to choose their own libraries and languages. What happens is sometimes developers feel like a particular library is okay to use, then they will start using it, developing some functionality around it. However, as per our mandate, for every new repository that gets added and scanned, a report gets published. Based on that report, we decide if we can continue. In the past, we have found, by mistake, some developers have used copyleft licenses, which are a bit risky to use. We immediately replace these with more permissive, open-source licenses, so we are safe in the end.
What is most valuable?
The static code analysis, which is integrated into the CI/CD environment, is a valuable feature. We get quick results of what has gone into the environment in terms of any vulnerability in the code and for the Eclipse plugins of Veracode. This is one of the more valuable features because a developer can get a sense at the line level if there are any issues.
What needs improvement?
It is pretty efficient when creating secure software. For one or two particular applications, the dynamic code analysis can take too much time. Sometimes, it takes three days or more. That is where we find speed getting dragged. Apart from that, it is pretty efficient for us to get results and make our software secure.
If the dynamic scan is improved, then the speed might go up. That is somehow not happening. We have raised this concern. It might also help if they could time limit scans to 24 hours instead of letting them go for three days. Then, whatever results could be shared, even if the scan is not complete, that would definitely help us.
They could probably provide some plugins for the Visual Studio code.
For how long have I used the solution?
What do I think about the stability of the solution?
It is pretty stable with no issues.
What do I think about the scalability of the solution?
If they need to scale back-end infrastructure to make the scan faster, then they should do it. Apart from that, there are no issues to mention.
One person can just start a scan. In our case, the DevOps team does it. They configure it once, then do it. However, the cycle takes time, depending on the codebase size, to look at an issue, identify if there are true positives, and then work on it. It is one person's almost full-time job.
I have a team of around six security professionals team who work on Veracode and use the tool. Two of them are team leads, two of them are senior developers, one is a DevOps engineer, and another one is a junior developer.
How are customer service and technical support?
We normally create a ticket for Veracode support, then they respond back within 24 hours. Our experience with them is generally very positive.
Normally, the report that we get is self-explanatory, but sometimes there are false positives or some issues that we don't understand. For those, we schedule a consultation call, where they then come on a call and provide guidance on how to fix them. That is pretty cool.
Which solution did I use previously and why did I switch?
Before Veracode, we had a manual process where we hired white hat hackers. They used to do all the scanning, then submit a report. That process was pretty lengthy. It sometimes could go on for three to six months. Nowadays, for static code scanning, we are doing it on regular basis. Since there are not many issues reported, we can fix them on the fly. For dynamic code analysis, it still takes a week's time because the scanning itself takes three days sometimes. Then, once the scanning is done, we check if there is an issue, fix it, and then start the scan. That is a week-long process, but the rest is pretty under control.
How was the initial setup?
They have done some improvements on the triage screen where you can look at all the issues. You can perform various actions over there, like mitigations or adding comments. They have simplified that interface a bit and made it a little faster. Earlier, we used to take quite a time for the check-in and check-out operations. However, now, it is quite fast. If we had to redeploy it from scratch, it would take around 30 minutes.
To start a static code scanning, do an upload, and start a scan, it hardly takes 10 minutes.
What about the implementation team?
We do the setup and implementation ourselves.
What was our ROI?
Veracode has definitely helped us close deals with the software being compliant to our customers' various standards.
Before we had Veracode, customers might have demanded some scanned compliance reports, which we didn't have. Because of that, we might have lost some customers during the pre-sales cycle. That cost is huge compared to what we are paying for Veracode.
It has saved our developers' time from six months to two weeks.
What's my experience with pricing, setup cost, and licensing?
If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount.
Which other solutions did I evaluate?
We also used Contrast Security for real-time scanning on an experimental basis. If that is successful, we will probably roll that out. Contrast Security is very focused on run time scanning. Veracode also has some kind of module for this that we have not explored. However, the Contrast Security tool was suggested to us by one of our customers. We have not compared Veracode and Contrast Security yet.
The other tool which we use is Burp Suite for performing some manual verification. This is apart from what Veracode is not able to. Our customers are also reporting some vulnerabilities because they have their own scans. To verify those types of issues, we use Burp Suite. Burp Suite is pretty handy when you want to quickly do some penetration testing and verify some vulnerabilities. It is definitely a unique tool, and I don't think there is this kind of module with Veracode.
What other advice do I have?
I'm pretty confident about Veracode's ability to prevent vulnerable code from going into production when I'm using it.
When you use Veracode, instead of using it as a manual tool, you should integrate it into your CI/CD pipeline. This way, every build is certified. Then, if there is an issue, you will know about it earlier in the development cycle, not later. Because as the time passes, it becomes more difficult to fix that issue.
With Veracode's support for cloud-native applications, there are some components of our application (which are cloud-native), that we treat in the same way as regular software, e.g., the source code and dynamic URLs. We don't have a model where we can do the real-time scanning. This is something which is currently in talks for maintaining the security of the distributed application. Hopefully, that should get implemented in about two months' time.
The reports that they share have been pretty informative, but someone has to go through them and read them quickly. In the early days, they might have offered some kind of training plan, but we did not opt for that.
Veracode has a plugin which we use, and it works with developer tools.
While there are false positive, there aren't much (around 10 percent). We normally farm these to the Veracode team, who act accordingly. Our developers still report 90% valid issues, and this is satisfactory for us.
Biggest lesson learnt: Security should not be an afterthought.
I would rate this solution as an eight out of 10. I took off points due to the extra time that it takes to do the dynamic scan.
Which version of this solution are you currently using?