Developing a Revolutionary Vulnerability Management Platform for an Industry Innovator

Solution

We joined the project at the very beginning, in the fall of 2020, and offered our services as a dedicated team, becoming a full-time custom software development provider. For the most part, the system architecture and domain model of the project were created on the client’s side, but we are also actively offering our ideas and suggestions for improvements. As for the actual technical implementation, we delivered every software development aspect, thus transforming the brilliant idea of a modern security solution into reality.

While having extensive expertise in diverse tech stacks and cutting-edge technologies, none of our experts in the assembled dedicated team had any previous experience working with Amazon Cognito. We needed to quickly learn how to work with Amazon Cognito to implement authorization and authentication functionality on the platform. When we successfully achieved this, we found out about more challenges concerning this AWS product — it was hard to scale and customize for our goals, so we needed to put in additional effort to make it work.

As for integration with third-party security solutions, we began with Netsparker and Acunetix, web scanners. The plan for the first version of MVP was to integrate a few scanners, each responsible for its respective area: scanning websites, repositories, and libraries. During the development process, it was decided to include more scanners to attract more customers. 

We have currently integrated with 10 leaders in the security products market, including the following:

• Netsparker and Acunetix for web testing
• Cloud Guard (Dome9), AWS Security Hub, and Prisma Cloud for the testing of the cloud infrastructure
• SNYK for scanning of libraries
• Fortify, Checkmarx, Code Inspector, and Veracode for the code analysis.

At first, we started with application scanners, but later, the client decided to integrate with security products that can scan the cloud infrastructure which is on an entirely different level of security products, compared to scanners. The main blocker here was the fact that our domain infrastructure was created for application scanners, so we had to rebuild it according to the new demands, adding a lot of significant changes to the code. This was required for mapping the Cloud Guard (Dome9), AWS Security Hub, and Prisma Cloud, getting the correct results, and normalizing them.

It is important to acknowledge our efforts in creating an outstanding user interface. The design team consisted of two Front-End developers and a UI/UX designer, who created from scratch the 1.0 version of the user interface and completely redesigned it two months before the release date set by the client. It happened because the initial vision of the product has undergone several gradual market-related adjustments during the project’s later stages. This has impacted the product’s GUI and architecture across the system to quite a significant extent. We have seamlessly integrated all the required market-dictated changes, including those to the system’s software architecture.

We also successfully dealt with the challenge concerning the TimescaleDB built on PostgreSQL and optimized it for fast ingest and complex queries. We used this open-source time-series database to read and visualize data for reports. The TimescaleDB was used as a statistical solution for the first few months, but we later felt the need for something more scalable. So, we decided to remove the TimescaleDB and use our custom statistical solution for reading and visualizing data for reports.