Product Overview of Contrast Security
Contrast Security is a comprehensive and innovative platform designed to provide deep-seated application security throughout the entire software development lifecycle. Here’s a detailed look at what the product does and its key features:
What Contrast Security Does
Contrast Security empowers organizations to secure their entire application portfolio, including web applications, cloud-native applications, APIs, and open-source components. The platform integrates development, security, and operations (DevOps, AppSec, and SecOps) to ensure that secure code moves efficiently through the organization. It embeds security testing throughout the development lifecycle, improving accuracy and speeding up the identification and remediation of vulnerabilities.
Key Features and Functionality
Comprehensive Platform
The Contrast Security Platform is the central hub that orchestrates all security analyses, stores data, and manages workflows. It includes several key components:
- Sensors and Agents: Embedded agents and API connectors monitor applications in real-time, analyzing application execution and runtime behavior. These agents support various programming languages such as Java, .NET, Node.js, PHP, Python, and Go.
- Database: Stores information about applications, vulnerabilities, and analysis results.
- Workflow Engine: Automates tasks like scan scheduling, reporting, and vulnerability tracking.
- User Interface: Provides access to tools, reports, and security insights.
Core Products
- Contrast Assess: Offers interactive application security testing (IAST) to identify software vulnerabilities in real time while developers write code. It reduces alert noise and eliminates the need for specialized security expertise.
- Contrast Protect: Embeds automated and accurate runtime protection within the application to continuously monitor and block attacks. This ensures applications are defended wherever they run.
- Contrast Scan: A source code scanning tool (SAST) built to eliminate inefficiencies in static application security testing. It prioritizes the most pressing vulnerabilities to deliver fast, accurate, and actionable results.
- Contrast SCA (Software Composition Analysis): Protects the software supply chain by identifying real threats from third-party libraries across the entire software development lifecycle. It prioritizes vulnerability remediation based on which libraries are actively being used.
- Contrast Serverless: A purpose-built cloud-native application security testing solution for securing Azure Functions and improving security posture in cloud environments.
Runtime Security Platform
- Real-Time Protection: The Contrast Runtime Security Platform prevents exploits in production and insecure programming during development. It operates from within the application, leveraging the power of instrumentation to embed security within the application’s runtime.
- Real-Time Alerts and Insights: Provides instant protection and visibility, monitoring application behavior through built-in sensors to assess HTTP streams, SQL queries, library usage, and other sources of behavior telemetry.
- Risk-Scoring Engine and AppSec Model: Includes a risk-scoring engine and an AppSec model to help organizations assess and manage security risks effectively. It also offers centralized policy management and modern data-streaming architecture.
- Instrument, Observe, Enforce: The Intelligent Application Agent installs within the local runtime environment, monitors application behavior, sequences events into traces, and watches for behavior patterns that violate defined security policies. Malicious activity can be instantly blocked, and findings are reported to the central console for alerting and reporting.
Additional Capabilities
- Application Detection and Response (ADR): Identifies vulnerabilities, detects threats, and stops attacks targeting custom applications and APIs. This feature empowers security teams to protect applications against the ever-evolving threat landscape.
- Confidential Computing: Leveraging Confidential Computing technology, Contrast ensures data encryption in use, workload isolation, and remote attestation, providing a secure environment for sensitive information.
In summary, Contrast Security offers a unified platform that integrates seamlessly into the software development lifecycle, providing real-time security testing, automated protection, and comprehensive visibility. This approach enables organizations to secure their entire application portfolio with high accuracy and speed, fostering a secure and efficient development environment.