OpenText home page.
Customer stories

Centralny Ośrodek Informatyki logoCentralny Ośrodek Informatyki (COI)

Security testing automation helps COI develop consistent and scalable software development processes for digital public services

Centralny Ośrodek Informatyki logo

About Centralny Ośrodek Informatyki

Centre for Information Technology (COI - Centralny Ośrodek Informatyki) is Poland’s largest public sector IT organization, creating and maintaining digital solutions for citizens and public administration while supporting high software development and application security standards.
IT professional working at a computer workstation in a data center with server racks in the background
  • Established:
    2010
  • Team:
    1,800+ specialists
  • Area of operation:
    Digital public services IT

Summary

Challenges

  • Developing and maintaining digital public services.
  • Identifying potential software vulnerabilities early.
  • Automating selected security testing activities.

Solution

  • Use OpenText™ Fortify™ SAST to analyze source code for potential vulnerabilities.
  • Move security activities earlier in development through a shift-left approach.
  • Automate repeatable tests.

Results

  • Earlier identification of potential vulnerabilities
  • Greater automation and repeatability of testing
  • Support for DevSecOps processes

Challenges

  • Developing and maintaining digital public services
  • Identifying potential software vulnerabilities early
  • Automating selected security testing activities

The development of digital public services involves not only creating new functionality but also continuously improving how these services are designed, tested, and maintained.

As the scale of COI’s projects grew, so did the importance of automating selected elements of the application security process. It was also important to detect potential vulnerabilities as early as possible, standardize testing methods, and efficiently communicate test results to the teams responsible for software development.

COI is developing an approach in which security considerations are addressed at increasingly early stages of software development, rather than only before a completed solution is deployed. With many projects running in parallel, tools that support automation and the gradual standardization of practices across different technologies play an important role.

Solution

Fortify SAST supports COI in conducting repeatable security tests and automating selected activities. It helps ensure consistency in testing processes and provides a common framework for analyzing test results.

Products deployed

Supporting static security analysis of source code

The solution enables code to be analyzed for potential vulnerabilities during software development. This allows teams to receive information earlier about potential issues requiring analysis and to incorporate security into the application development lifecycle.

Fortify SAST supports a “shift-left” approach, moving some security activities to earlier stages of the software development process. This helps integrate security more closely with development teams’ work and advance DevSecOps practices.

Moving security closer to the development process

Integrating automated code analysis into the software development process makes it possible to identify some potential issues earlier than when testing is conducted only in the final stages of a project.

As a result, security becomes a continuous part of the application development lifecycle. Development teams receive the information needed to assess code more quickly, while security specialists can organize and analyze test results more efficiently.

Making automation part of the security process

For an organization delivering many complex projects simultaneously, the ability to conduct tests consistently and apply uniform principles when analyzing their results is particularly important.

The SAST tool is used to run repeatable tests. It supports the automation of selected activities while leaving experts with the key role of analyzing results, assessing risk, making decisions, and taking appropriate action at subsequent stages of application development. It is one element of a broader approach to software quality and security.

 

Results

The use of Fortify SAST primarily supports COI with earlier identification of potential vulnerabilities in code, greater automation and repeatability of security testing, and more efficient analysis and use of test results in the software development process. 

Earlier identification of potential vulnerabilities in code

Automated code analysis enables some issues to be detected during application development. Teams can therefore analyze them earlier and decide on the appropriate course of action.

This approach reduces the risk of security issues accumulating in the final stages of a project, when resolving them may require more extensive changes to the application’s code or architecture.

Greater process repeatability

Automation enables testing to be conducted according to defined principles regardless of project scale. In a large IT organization, this is particularly important because it helps build a common approach to security across different teams and projects.

Standardization does not replace expert assessment of results, but it helps organize the process and reduce the number of routine activities performed manually.

Support for DevSecOps processes

Fortify SAST is one of the tools supporting the development of the DevSecOps approach at COI. Automating code analysis helps address security earlier in the development process and improves collaboration between teams responsible for software development and security.

For an organization creating digital public services, this makes it possible to continue developing processes in which security is an integral part of the entire application lifecycle.

Blog

Glowing lock icon on shield representing application security

Fortify CLI (fcli): Streamlining AppSec workflows with SSC and ScanCentral SAST

Discover how Fortify CLI (fcli) can help streamline application security workflows with OpenText Application Security and ScanCentral SAST, bring powerful command-line capabilities to AppSec processes, and help teams work more efficiently with Fortify solutions.

Read the blog

How can we help?