R&S®Trusted Application Factory

Deliver trustworthy cloud native applications, by embedding advanced

protection into your DevOps practices.

The challenges of modern cloud native applications

One approach is not enough

Security tools like SAST and DAST only expose the vulnerability and, by using only one approach, it’s easy to miss critical issues.

It is not all about vulnerabilities

The OWASP Top 10 must be taken into account, but keep in mind that attacks like credential stuffing, are just as important.

Legacy WAFs acting in warning mode

The traditional false positive management model is not suited to the agile software factory we find in cloud native and microservices approaches.

Meet our cloud native application protection solution

	SAST	DAST	R&S®Trusted Application Factory
Broken Access Control
Cryptographic Failures
Injection (SQL, command, LDAP, etc.)
Insecure Design
Security Misconfiguration
Vulnerable & Outdated Components
Identification & Authentification Failures
Software and Data Integrity Failures
Security Logging and Monitoring Failures
Insufficient Logging & Monitoring

What does R&S®Trusted Application Factory do for DevSecOps teams?

Reduce complexity with standard configuration files

This containerized solution is implemented directly within the CI/CD pipeline with the already existing tools like Gitlab, Jenkins etc to simplify collaboration. Achieving interoperability within the CI/CD domain is key.

Same formats (as YAML, GO like), form factor (Docker images), languages and concepts are used which results in easy management, low TCO and no new learning curve for developers.

Increase ROI by automatically adapting to app traffic

The solution is deployed close to the application. This enables users to scale up or down at the same time as the application, using their orchestrator, in Kubernetes or Docker clusters. Thus, it can automatically adapt to the application load. This diminishes costs of resources and augments return on investment (ROI).

Simplify approach with proactive engines and whitelisting

The solution activates security engines built on 20 years of expertise, rate limiting, and bot mitigation capabilities to respond to OWASP Top 10, zero-day attacks, DoS and threats like credential stuffing that do not exploit CVEs. Built with API first mindset, it allows OpenAPI file enforcement to secure your entire lifecycle.

Improve security with context enriched description

The solution along with context description is integrated in a configuration file close to the application code. This keeps security up to date and aligned with application’s version. Security policies can be adapted automatically by invoking relevant security engines. Thus, it improves overall security with fewer false positives.

Our points of differentiation

High level of innovation

Focus on false positive reduction by effective approaches like context description, positive security model, etc.
Increase accountability by versioning of security policy
Utilize security engines built on 20 years of proven expertise

Intelligent scaling options

Save resource related costs by scaling out or down automatically
Update easily leveraging microservices
The containerized technology addresses the needs of your modern cloud native applications

See our featured resources

Security As Code

This white paper summarizes everuthing you need to know about Security-as-Code and how DevSecOps can help your business succeed.

DevSecOps Community website

The DevSecOps Community is a website for DevSecOps teams. Join this community of cloud native application developers and application security experts to broaden your knowledge, facilitate your daily work and increase your technical know-how.