Parkeon Delivers Secure Payment Solutions With Seeker

Solution evaluation

Parkeon builds complete payment solutions that centralize electronic payment flows on behalf of their clients. Both activities require overall solution architecture compliance to standards and norms in the industry such as PCI DSS (Payment Card Industry Data Security Standard).

Parkeon had been using a dynamic application security testing (DAST) tool to validate the security of applications in their integration environment, but the solution was not working as they had hoped.

The application is developed using agile development methods and is updated in production five times per quarter. Parkeon needed a tool that integrates security validation into existing automated processes and is easy to operate by developers and testers who are not security experts.

Deployment and benefits realized

While using Seeker, Parkeon has identified three key benefits.

First, Seeker understands and verifies how data flows through the application, ensuring that the entire system, end to end, complies with security standards such as PCI DSS. It also identifies vulnerabilities in relation to their impact on sensitive data.

Seeker provides testing that helps meet PCI DSS Section 6 requirements. By automatically tracking critical data, such as credit card information, through various components of the payment chain, Seeker verifies that there are no vulnerabilities, such as forgotten debug data, insecure manipulation, insecure storage—even temporarily—in a file or database, insecure transmission to third parties, and so on, that may compromise it. With Seeker, Parkeon can automatically ensure that the overall system complies with security standards at each release.

Second, Seeker facilitates communication between test and development teams by pinpointing vulnerabilities back to the source code. Unlike other dynamic testing tools, which report vulnerabilities by the offending URL, Seeker automatically ties vulnerabilities back to the source code to identify where the fix must be applied. It reduces false positives to near zero, pinpoints the vulnerable source code, and provides developers with clear remediation advice tailored to the tested application.

Using Seeker, Parkeon improved security, reduced the amount of time spent on security testing, and improved communication between security and R&D:

• Developers focus their time on proven vulnerabilities and source code corrections recommended by Seeker.
• Testers gain a clear view of the application’s risk posture in relation to the OWASP Top 10 criteria and Parkeon’s corporate security standard.

Third, Seeker improves security awareness and trains developers to exercise secure coding practices as outlined by the OWASP Top 10. By explaining business risks and providing detailed contextual remediation suggestions, Seeker has helped Parkeon’s test and development teams acquire awareness and training in an ongoing manner, thus improving the security of their code.

Conclusion

Seeker fits seamlessly into Parkeon’s security automation process, ensuring that their development and testing teams deliver frequent, secure, and compliant releases to production, while improving productivity and security awareness.

Download the PDF