StarcSec | Case Study

  • Date: 24 April, 2023
  • Category: Development, Saas, App

SecureBank had a security breach resulting in the loss of customer assets. This has led to a huge financial and reputational loss in addition to regulatory scrutiny. The bank’s CEO appoints an independent consultant, John, to investigate the incident.

John interviews Sam who is an expert in managing and using source code scanning tools, Daniel who runs application scans once the application is deployed and Sumit from engineering who is responsible for fixing issues in the application. The bank also works with bug bounty vendors and third-party pentesters who find security gaps continuously.

John can find the security issue that the hackers exploited to break into the bank’s systems. He goes through all the reports generated by code scanning tools, application scans and third-party vendors and is surprised that this issue was identified in these reports. John then meets Sumit to understand why this issue was not fixed. Sumit admits to John that his team was under pressure and was never sure what issues to prioritise and fix as they are overwhelmed with security issues pushed to them by the various tools and vendors.

Finally, John met with the CIO and CISO to understand the governance around cybersecurity and why such a critical security issue was missed by their teams. Their primary concern remained in the lack of visibility of the security posture. With the volume of scans and assets, it’s becoming difficult to understand what applications were scanned, what are the truly critical issues and the remediation status.

John submits his investigation report to the CEO and strongly recommends investing in a platform that solves the problem raised by the teams.

StarcSec brings an intelligent platform that integrates with all open-source and commercial scanning tools, runs machine learning on the results from tools and third-party reports and provides the right visibility which allows teams to focus on actions where it’s needed the most. Ensuring no asset goes unscanned and the most important risks are highlighted based on the business context. The CIO and CISO can track the posture from the centralized dashboard. Sumit gets notified only when there is a real critical issue to fix and prioritize the remediation. Sam and Daniel can now focus on ensuring all applications are scanned at a regular frequency and letting the platform run and manage the tools. And finally, this assures the CEO who can demonstrate to regulators the bank’s mature application security program.