Security & Privacy at NetRise
As a leader in Software Supply Chain Security, our own security and compliance is foundational to our customer’s success.
Product & Enterprise Security
Penetration Testing
NetRise engages with one of the best penetration testing consulting firms in the industry at least annually. All areas of the NetRise product and cloud infrastructure are in-scope for these assessments, and source code is fully available to the testers in order to maximize the effectiveness and coverage.
Vulnerability Assessment
NetRise requires vulnerability assessments at key stages of our Secure Development Lifecycle (SDLC):
- Static analysis (SAST) testing of code during pull requests and on an ongoing basis
- Software composition analysis (SCA) to identify known vulnerabilities in our software supply chain
- Malicious dependency scanning to prevent the introduction of malware into our software supply chain
- Dynamic analysis (DAST) of running applications
- Periodic network vulnerability scanning
- Continuous external attack surface management (EASM) to discover new external-facing assets
Endpoint Protection
All corporate devices are centrally managed and equipped with mobile device management and anti-malware protection. Endpoint security alerts are monitored 24/7/365. MDM is used to enforce secure configuration of endpoints, such as disk encryption, screen lock configuration, and software updates.
Vendor Security
NetRise uses a risk-based approach to vendor security. Factors which influence the inherent risk rating of a vendor include:
- Access to customer and corporate data
- Integration with production environments
- Potential damage to the NetRise brand
Once the inherent risk rating has been determined, the security of the vendor is evaluated in order to determine a residual risk rating and an approval decision for the vendor.