Product & Application Security
Application & Software Security​
Security by Design​
Security is integrated into Definity's software development lifecycle from planning through deployment and maintenance.
Development teams follow defined secure development practices designed to identify and address security risks early in the lifecycle.
Security analysis, code review, testing, and controlled change processes work together to reduce the likelihood that vulnerabilities reach production.
Secure Software Development Lifecycle​
Definity maintains a formal Software Development Lifecycle covering development, acquisition, implementation, changes, maintenance, and emergency changes.
Development, testing, and production environments are separated to reduce the risk of unauthorized or unintended production changes.
Our development process incorporates:
- Secure coding practices
- Automated security analysis
- Peer code review
- Security testing
- Regression testing
- Controlled production releases
- Change authorization
- Vulnerability remediation
- Post-implementation monitoring
Code Review & Automated Security Analysis​
Security analysis is integrated into the development workflow.
Automated security analysis runs during relevant code commits and merges, with findings surfaced to the development team for review.
Pull requests capture relevant change information and undergo automated and manual peer review before code is merged.
Merge permissions are restricted to authorized personnel.
Security Testing​
Security testing is incorporated throughout the product lifecycle.
Testing includes appropriate application and infrastructure security assessments, vulnerability assessments, penetration testing, and security and regression testing.
The objective is to identify security weaknesses early and provide defined paths for remediation before production deployment.
Change & Release Management​
Production changes are authorized, documented, tested, reviewed, and approved before implementation.
Definity maintains defined responsibilities for requesting, reviewing, approving, and implementing changes, with appropriate segregation of responsibilities.
Release information is communicated to relevant stakeholders, and post-implementation monitoring is used to confirm system stability and identify issues requiring further action.
Emergency changes follow a defined process that allows urgent remediation while maintaining appropriate authorization, documentation, and oversight.
Vulnerability & Patch Management​
Vulnerability Management​
Definity maintains a vulnerability management program designed to identify, evaluate, prioritize, and remediate security vulnerabilities.
Vulnerabilities may be identified through:
- Penetration testing
- Automated scanning
- Security assessments
- Dependency analysis
- Security monitoring
- Internal security activities
- External research
Findings are evaluated according to severity, exploitability, exposure, business impact, affected systems, and available mitigations.
Security Testing & Penetration Testing​
Definity conducts independent third-party penetration testing at least annually.
Testing may cover applicable applications, infrastructure, APIs, and other components within the defined assessment scope.
Findings are tracked through Definity's vulnerability management process. Critical and high-risk findings receive prioritized attention and are addressed through remediation or appropriate mitigating controls.
The most recent independent penetration test, conducted after remediation of the initial findings, confirmed that all critical and high-severity vulnerabilities had been remediated and that no such findings remained.
Patch Management​
Definity maintains processes for routinely patching infrastructure and software and responding to newly identified vulnerabilities.
Automated patching is used where appropriate, while vulnerabilities requiring additional attention are addressed through defined remediation processes.
Our objective is to reduce the window between vulnerability discovery and effective remediation.