Document Logistix Combines SAST and DAST to Ensure Security of Sensitive Customer Data

The challenge

Document Logistix’s application Document Manager provides a flexible platform for paperless business processes and highly efficient archiving. Because it’s not designed for a specific market, Document Manager is customizable for a large range of business processes, including those as straightforward as proof of delivery, where the risk of data loss is fairly minimal, and those involving more sensitive information like human resources records. This is especially important since the EU’s General Data Protection Regulation (GDPR) went into effect, which has financial penalties for noncompliance.

Attorneys general in the U.S. also use Document Manager for disclosure purposes, publishing prosecution case material to defense attorneys. Failure to protect this information could lead to mistrial.

With such high stakes, Document Logistix has always been focused on protecting customer data, but the company lacked a true application security solution. Several of its clients performed their own penetration testing and submitted issues to Document Logistix to remediate. The company also had internal staff checking code manually for security vulnerabilities, but this proved to be time-intensive and costly. The company needed an in-house solution that was both cost-efficient and effective. 

The solution

Document Logistix used SAST to scan code for errors and ensure secure product design. It then added Continuous Dynamic to detect and assess code changes in running applications, alert of new vulnerabilities, and provide reporting and intelligence metrics.

Continuous Dynamic Threat Research provided Document Logistix with an added layer of protection against security vulnerabilities. At the end of each day, any new code was uploaded to Threat Research, checked by a Black Duck security expert, and sent back to Document Logistix in an automated report that identified anomalies to be addressed.

The results

The combination of SAST and DAST provided Document Logistix with a platform for testing its application and DevOps environment, automating the processes required to comply with the complex rules of paper and electronic document management. This included full auditability of its application, the ability to plan workflows, perform complex retention policy management, and define policies for certain classes of documents, including what documents should or shouldn’t be disclosed and to whom.