Sorry, not available in this language yet

English
日本語
简体中文

AppSec SaaS Platform | Integrated, cloud-based AST solution optimized for development and DevSecOps teams.
AppSec IDE Plug-ins | Secure code as you write it in your IDE
Software Risk Management | Manage application security programs at enterprise scale
DevSecOps Integrations | Integrate AppSec tools into DevOps workflows

Static Analysis (SAST) | Address security and quality defects in code as it's being developed
Software Composition Analysis (SCA) | Secure and manage open source risks in applications and containers
Interactive Analysis (IAST) | Automate web security testing within your DevOps pipelines
Dynamic Analysis (DAST) | Continuous web application security testing in production.
Penetration Testing | Identify business-critical vulnerabilities with on-demand testing expertise.
Protocol Fuzzing | Identify defects and zero-day vulnerabilities in services and protocols

Program Strategy & Planning | Measure, scale, and optimize your AppSec program
Threat & Risk Assessments | Understand and address internal and external security risks
Security Training | Equip development teams with the skills they need to produce more secure software
Implementation & Deployment | Optimize utilization, management and deployment of AppSec tools
Security Testing Services | On-demand AppSec testing resources and expertise

Open Source & Security Audits | Comprehensive technical due diligence services for M&A

AI-generated code | Harness the power of AI coding assistants while managing the risks
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Consolidation | Simplify your application security program
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud
Open Source License Compliance | Effective solutions for ensuring open source license compliance
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators

Dev and DevOps Teams | Build secure software while maintaining developer productivity and pipeline velocity.
Security Teams | Align people, processes, and technology to minimize software risk and transform your business.
Legal Teams | Solutions to protect your IP and manage risk.

Financial Services | Protect sensitive customer and financial data from rapidly evolving security threats.
IoT & Embedded | Ensure your embedded and IoT devices are safe, secure, and reliable.
Automotive | Build software security & reliability into the modern connected car.
Telecommunications | Create seamless and safe mobile experiences, from silicon to software.
Aerospace & Defense | Solutions for automating mission-critical development.
Public Sector | Application security for government agencies and their suppliers.
Medical Device | Safeguard medical devices and applications.

Taking a Preventative Approach to Cloud Security

Rally® (www.rallyhealth.com) simplifies health care, making it easier for companies and employees to manage complex benefits and improve overall health. Among its other responsibilities, the Rally development team supports critical services within the Rally digital ecosystem to establish user identities and to verify eligibility. Rally uses cloud provider PaaS services and an IaaS virtual infrastructure (including Amazon Web and Relational Databases Services, as well as MongoDB and Scala) that span their identity management, provider, patient eligibility, end user, and privileged user systems.

We wanted a thorough architectural risk analysis on our cloud infrastructure, especially around our authentication and eligibility systems. We wanted someone who was extremely tech-savvy, which was a hard requirement for us. One of the reasons we chose Synopsys was for that level of technical expertise, and that we were guaranteed to have the same person who interviewed with us to do our review, which some of the other candidates couldn’t guarantee."

Nathan Coleman

Rally Health, Inc.

Rally had three major areas encompassing their external security evaluation:

The security posture of their core authentication and authorization systems.
Their security controls.
Insight into the threat landscape for their runtime environment.

Synopsys’ services for Rally included an architectural risk analysis (ARA), a configuration review, and a code-assisted penetration test.

The configuration review provided an in-depth assessment of the security posture of Rally’s cloud infrastructure and audited the runtime configuration of their deployed cloud applications and security controls to identify weaknesses, giving a snapshot report describing how the configuration met or did not meet security goals.
The penetration test identified what sensitive data was managed within Rally’s business model and explored applications to catalogue exposed portions subject to attack and how they might be exploited. Each issue was tested in order of perceived risk using a hybrid of manual and tool-based analysis for both runtime and secure code analysis.

“The ARA verified our understanding about the architecture and provided recommendations for us,” says Coleman. “The coded system penetration test and configuration review gave a clear path for remediation—‘here’s an issue with the configuration and here’s how you fix it.’ The penetration test was informed by the ARA, giving less false positives. The configuration review was probably the easiest to directly funnel to our workflow.”

“Our overall experience with Synopsys was professional and informative,” concludes Coleman. “We really want to be involved in the security community, and we really want to push the envelope of security. Working with Synopsys helped us move closer to both those goals.”

Download the PDF

Company Overview

Rally Health, Inc., is a consumer-centric digital health company that makes it easy for individuals to take charge of their health and wellness, working with health plans, providers, and employers to reimagine consumer health engagement. Rally’s integrated platform helps employees, payers, providers, and employers maximize the potential of their health and the health care system.