Application security and development

Rencore builds security into its development lifecycle and tests Rencore Governance against SQL injection and the OWASP Top 10.

Application

If Rencore’s system or application is web-based and connects to a database, what measures have been taken to prevent SQL injection?

In line with Rencore’s Secure Development Lifecycle Policy, a number of good practice security measures are in place, including using parameters to sanitize the user input and the use of source code security scans to identify potential issues before they have any chance to be deployed into production.

Has Rencore tested the system or application against OWASP Top 10 issues and other security vulnerabilities?

Rencore uses a number of measures to help secure Rencore Governance, including good security practices embedded into software development lifecycle, external security testing and internal scanning that includes code scanning and running of OWASP ZAP (Zed Application Proxy) attacks against the solution, ensuring none of the OWASP vulnerabilities are present.

Secure development and change management

Does Rencore use any form of SDL (security development lifecycle) in its code development framework?

Rencore has a fully developed software development lifecycle that embeds security into this framework. Rencore makes use of vulnerability scanners and security analyzers on the codebase, one of which is Veracode. However, the underlying principle of our development process is that everyone should be alert regarding security - we ask everyone involved in all stages of the development lifecycle to ask themselves the following questions, among others:

• What are the risks?
• How could something go wrong here?
• What would the impact be if something goes wrong?
• How are we going to secure this?
• Is this the right thing to do?
• Are we in compliance with GDPR and other relevant privacy laws?
• Can we do this with fewer administrative privileges?
• Is this data-sensitive?
• Are we encrypting the data properly?

Everyone involved in product development is required to ask questions, assess risks, and do the right thing at every step during the lifecycle of our software.

Please explain how Rencore handles defects and describe the process for bug handling.

Bugs, requests for improvements and changes are reported by customers to our support team. They classify and escalate accordingly to the Product team for verification, implementation, and roll-out. This process is consistent with Rencore’s Vulnerability Management Policy.

In Rencore’s quality assurance testing, do you make use of automated and manual testing?

We have a growing set of automated functional UI, unit and integration tests and we also perform stringent manual testing of all features and bug fixes.

In Rencore’s quality assurance testing, do you verify the performance aspects of the application?

Yes. We run automated functional UI tests, and we perform performance tests to understand where there may be bottlenecks. We also investigate the performance recommendations of the services running in Azure.

Rencore Governance scanning is limited by the hosted services we analyze (Microsoft 365). The performance of the analysis is therefore always limited to that of the Microsoft online services’ throttling restrictions.

In your quality assurance testing, do you check for security vulnerabilities?

We use the OWASP ZAP tools to execute OWASP Top 10 attacks against the application to check for vulnerabilities. We are also guided by the general principle that security is everyone’s concern.