Veracode Policy Manager

Veracode Policy Manager provides CISOs with a dashboard that offers a centralized view of their portfolio of internal and third-party applications with details on how each application is performing from a security policy perspective. Policy Manager’s easy-to-use interface offers specific compliance requirement tracking capabilities and enables users to tick through a series of best practice-based or customizable drop-down menus that identify appropriate security policy options, including recommended remediation times based on the criticality of the flaw, criticality of the application and established CISO requirements.

Tackling Application Security

What do Google, RSA, Sony, PBS, Barracuda Networks, HBGary and numerous other high profile organizations have in common? All have been breached through vulnerabilities in software applications and often by applications that they didn’t develop, but rather purchased from third-parties. One thing is clear—Software is the Achilles’ heel of information security; vulnerable applications represent a critical area of exposure and a highly significant risk to the business. And yet, while organizations take a rigorous approach to quality assurance of their applications from a functional perspective, very few have anything close to a systematic, policy-based program for detecting and remediating software security flaws.

Software security programs can vary widely in effectiveness and efficiency. As depicted below the state of application security in an organization ranges from ad-hoc testing for a few key projects to a systematic, cohesive approach in which security is thoroughly baked into corporate business processes.

With the introduction of its Policy Manager, Veracode’s cloud-based application risk management (ARM) platform now provides the means to coordinate a complex policy-based software testing program across the enterprise and its extended software supply chain. Cloud-based services such as Veracode’s enable an enterprise to scale and manage a policy-based application security program, through automated testing and online capabilities for defining and assigning policies, and monitoring results and security trends. In particular, automated static binary analysis through a cloud offering is a highly effective method for detecting vulnerabilities and is the only way to analyze third-party applications and components, when no source code is available.

Veracode Security Solutions

Security Threat Guides