Based on IBM watsonx^™ technology, IBM Concert^® is a solution designed for optimizing application management and operations. And the development team responsible for this offering was under pressure to deliver the product to general availability (GA) while meeting IBM’s stringent requirements for mitigating security risks in the product’s code.   

It’s a challenge familiar to product dev teams everywhere: in parallel with development, security assessment tools scan the code and generate lists of hundreds or thousands of Common Vulnerabilities and Exposures (CVEs). Most CVEs aren’t critical, but the work of sifting through the lists and prioritizing remediations can slow development significantly. If critical issues aren’t discovered until late in the dev cycle, loads of time can sink into rebuilds and retests. Thus, product readiness—and ultimately, revenue—are tied to proper CVE management. 

Fortunately for the Concert dev team, an innovative solution was right in front of them. One of the core use cases Concert supports is streamlining CVE management. So the product’s own developers became some of its first happy customers.  

Using Concert, the dev team created a smarter, more streamlined approach to managing CVEs. Previously, the team relied on a pair of third-party security assessment tools that generated unique lists of CVEs, including priority scores. The team would then manually analyze and correlate the two lists and subsequently communicate with the office of the IBM Chief Information Security Officer (CISO) to agree on priorities.

Now, the data from the third-party tools feeds into Concert, which produces a unified CVE list with more intelligent prioritization. The software’s underlying AI analyzes how each CVE relates to the application’s entire environment, including connections and entry points, and accounts for this in its priority ranking.

The CVEs and priority scores are also displayed on a graphical map, helping developers quickly understand how each CVE relates to the application and where work is needed first. “Concert goes further than the other scanning tools,” says Mahesh Dashora, Program Director of QA and Security and Release Engineering at IBM. “We’re getting better insight into exposures, so we can resolve the important items more quickly.”   

The team also benefited from these additional Concert features:

• Concert surfaces duplicate CVEs, helping the team fix issues in multiple places with a single remediation.
  
  
• Concert provides a dashboard that clearly displays CVEs, priority scores and supporting context, enabling efficient alignment with the office of the  CISO.
  
  
• Concert can be integrated with GitHub, facilitating the rapid population of service tickets with remediation details, to help accelerate fixes.
  
  
• Concert provides an Evidence store for documenting all decisions regarding CVEs, supporting audit readiness.