{"id":35319,"date":"2020-07-16T07:40:41","date_gmt":"2020-07-16T07:40:41","guid":{"rendered":"https:\/\/www.checkmarx.com\/?p=35319"},"modified":"2024-09-08T07:40:57","modified_gmt":"2024-09-08T07:40:57","slug":"top-three-benefits-of-cxflow","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/","title":{"rendered":"On the Road to DevSecOps: Top Three Benefits of CxFlow"},"content":{"rendered":"

Most organizations who are in the process<\/span> of transitioning to DevOps<\/span> understand that this new software development<\/span> methodology is really about a change of corporate mindset, improvements to internal practices, and the usage of development tools that increase an organization\u2019s ability to deliver software at higher rates. DevOps<\/span> enables organizations to provide timely software solutions to their customers and compete more effectively in the market in which they operate.<\/p>\n

Pertaining to development tools, DevOps<\/span> is also about automation <\/em>of the different tooling in use<\/em> that improves the speed of software delivery. Designed primarily for those embarking on DevSecOps<\/strong> initiatives, Checkmarx CxFlow integrates security<\/span> into the existing tools so that secure software development<\/span> can be achieved without requiring any extra tools. Using the existing tools already in place, CxFlow seamlessly operates in the background.<\/p>\n

Checkmarx CxFlow is all about the automation of AST solutions into the tooling within today\u2019s organizations. It was developed to address AST automation head-on, but there is more to CxFlow than meets the eye. Below is a list of the top three benefits organizations will experience when using CxFlow with their CxSAST<\/a> and CxSCA<\/a> deployments. Let\u2019s delve a little deeper into what CxFlow is all about.<\/p>\n

#1 The Most Shift-left Where Automation Can Occur<\/h2>\n

Traditionally, application<\/span> security<\/span> testing (AST) solutions on the market operate within the CI tooling in use and scans are normally performed after a merge\/build has taken place – further to the right of the SDLC, so to speak. CxFlow on the other hand, allows organizations to shift that functionality to the left since CxFlow is an orchestration layer that simplifies the implementation and automation of AST in today\u2019s modern development environments.
\nUsing CI plugins to launch AST scans are still supported and even recommended, for example, launching scans from Jenkins, CircleCI, Travis CI, Bamboo, TeamCity, etc.<\/p>\n

However, AST scans can now be integrated and launched directly from code management tools as well. CxFlow effortlessly integrates with application release orchestration and agile planning tools such as GitHub, GitLab, BitBucket, Azure DevOps<\/span>, etc., enabling fully automated scanning of applications and the delivery of consumable results to the developers themselves.<\/p>\n

Plus, CxFlow integrates directly with bug\/defect tracking tools like Jira, Rally Software, ServiceNow, SonarQube, etc. This eliminates the need for time-consuming manual scan configurations and allows developers<\/span> to publish and update findings based on policy to a defect\/backlog management system for application<\/span> teams to track.<\/p>\n

#2 End-to-End Automation, from Scanning to Ticketing<\/h2>\n

Leveraging Checkmarx\u2019s unique ability to scan uncompiled code, CxFlow automates<\/em> the steps required to scan code earlier in the SDLC<\/span>. This eliminates the need for time-consuming manual configuration of scans and allows developers<\/span> to publish and update scan findings based on a pre-configured policy<\/em> within the code management tools themselves. After the initial configuration, AST scan activity is performed hands-off with no human intervention required whatsoever beyond a pull request initiated by a developer<\/span>.
\nWith CxFlow, upon a pull request in the code management tools in use, the developer<\/span> not only receives notifications from scans as comments that are related to functionality, but also as comments that are related to security<\/span>, since CxFlow easily integrates with IDEs and code management tools in use. Just like that, the developer<\/span> is able to have their code reviewed once for all bugs and would be able to close the full feedback loop with ticketing systems, all while the code is still fresh in their mind<\/em>.\u00a0 This allows developers<\/span> to:<\/p>\n

    \n
  • Catch and fix vulnerabilities<\/span> during the coding phase (earliest stage of development).<\/li>\n
  • Work as usual with no disruptions, no new tools, no additional security reviews needed, etc.<\/li>\n
  • Treat security bugs and functional bugs alike and allows them to immediately address those bugs within the code branch(es) they\u2019re currently working on.<\/li>\n
  • Reduce the overhead of manually opening, validating, and closing security tickets without spending countless hours in bug tracking\/ticketing management systems.<\/li>\n<\/ul>\n

    #3 Removes Friction Between Developers and DevOps\/AppSec Teams<\/h2>\n

    CxFlow eliminates the manual and time-consuming configuration per project within DevOps<\/span>, thereby removing the friction between developers<\/span> and DevOps<\/span> teams when needing to add scanning steps into the jobs of all CI pipelines, since adding jobs\/steps to scan code is challenging using the older CI-scan model. Today, CxFlow:<\/p>\n

      \n
    • Simplifies the AST lifecycle through automation into the tools already in use by taking a web listener approach, listening for events from the source code repositories and triggering AST scan actions upon such an event.<\/li>\n
    • Enables developers<\/span> to have little if any intimate knowledge of CxSAST or CxSCA solutions since developers<\/span> receive their automated scan reviews as comments\/reports right from the repositories, not the AST solutions deployed.<\/li>\n
    • Works off the concept of a protected-branching strategy whereby you can configure master, develop, and security branches, for example, that are all deemed protected. This means that pull requests, push events, etc. will trigger scans and produce results when any code changes are made that are associated with those protected branches.<\/li>\n
    • Reduces TCO and improves ROI for scanning tools by reducing the need to manage and maintain multiple CI plugins concerning installation, updates, etc., when multiple CI solutions are in use.<\/li>\n<\/ul>\n

      Conclusion<\/h2>\n

      CxFlow streamlines the configuration and orchestration between the development tool set and the Checkmarx Software Security Platform to drive AST automation. With this, organizations can instantly onboard their development, security<\/span>, and operations teams and simplify the governance of their security policies and DevSecOps processes<\/span>.<\/p>\n

      The traditional AST solution providers are leaving developers<\/span> behind, because without the ability to scan source code directly, the traditional players can\u2019t efficiently work within code management tools similar to Checkmarx.<\/p>\n

      Clearly, integration is key to automation and CxFlow enables the most shift left approach where automation can actually occur within the SDLC\u2014changing the way AST solutions are integrated with in all DevOps<\/span> environments.<\/p>","protected":false},"excerpt":{"rendered":"

      Most organizations who are in the process of transitioning to DevOps understand that this new software development methodology is really about a change of corporate mindset, improvements to internal practices, and the usage of development tools that increase an organization\u2019s ability to deliver software at higher rates. DevOps enables organizations to provide timely software solutions […]<\/p>\n","protected":false},"author":15,"featured_media":55576,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[84],"tags":[205,243,254,144,147,270],"class_list":["post-35319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-application-security-vulnerabilities","tag-automation","tag-cxflow","tag-devops","tag-devsecops","tag-software-developers"],"acf":[],"yoast_head":"\nOn the Road to DevSecOps: Top Three Benefits of CxFlow<\/title>\n<meta name=\"description\" content=\"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"On the Road to DevSecOps: Top Three Benefits of CxFlow\" \/>\n<meta property=\"og:description\" content=\"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\" \/>\n<meta property=\"og:site_name\" content=\"Checkmarx\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-16T07:40:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-08T07:40:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Stephen Gates\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@checkmarx\" \/>\n<meta name=\"twitter:site\" content=\"@checkmarx\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stephen Gates\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\"},\"author\":{\"name\":\"Stephen Gates\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/1ea38abd0315d0956c3c9c173724345b\"},\"headline\":\"On the Road to DevSecOps: Top Three Benefits of CxFlow\",\"datePublished\":\"2020-07-16T07:40:41+00:00\",\"dateModified\":\"2024-09-08T07:40:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\"},\"wordCount\":978,\"publisher\":{\"@id\":\"https:\/\/checkmarx.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg\",\"keywords\":[\"Application Security Vulnerabilities\",\"Automation\",\"CxFlow\",\"DevOps\",\"DevSecOps\",\"Software Developers\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\",\"url\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\",\"name\":\"On the Road to DevSecOps: Top Three Benefits of CxFlow\",\"isPartOf\":{\"@id\":\"https:\/\/checkmarx.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg\",\"datePublished\":\"2020-07-16T07:40:41+00:00\",\"dateModified\":\"2024-09-08T07:40:57+00:00\",\"description\":\"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg\",\"width\":1024,\"height\":512},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/checkmarx.com\/#website\",\"url\":\"https:\/\/checkmarx.com\/\",\"name\":\"Checkmarx\",\"description\":\"The world runs on code. We secure it.\",\"publisher\":{\"@id\":\"https:\/\/checkmarx.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/checkmarx.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/checkmarx.com\/#organization\",\"name\":\"Checkmarx\",\"url\":\"https:\/\/checkmarx.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"width\":1,\"height\":1,\"caption\":\"Checkmarx\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\",\"https:\/\/x.com\/checkmarx\",\"https:\/\/www.youtube.com\/user\/CheckmarxResearchLab\",\"https:\/\/www.linkedin.com\/company\/checkmarx\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/1ea38abd0315d0956c3c9c173724345b\",\"name\":\"Stephen Gates\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_15.png\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_15.png\",\"caption\":\"Stephen Gates\"},\"url\":\"https:\/\/checkmarx.com\/author\/stephen\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"On the Road to DevSecOps: Top Three Benefits of CxFlow","description":"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/","og_locale":"en_US","og_type":"article","og_title":"On the Road to DevSecOps: Top Three Benefits of CxFlow","og_description":"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.","og_url":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/","og_site_name":"Checkmarx","article_publisher":"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","article_published_time":"2020-07-16T07:40:41+00:00","article_modified_time":"2024-09-08T07:40:57+00:00","og_image":[{"width":1024,"height":512,"url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg","type":"image\/jpeg"}],"author":"Stephen Gates","twitter_card":"summary_large_image","twitter_creator":"@checkmarx","twitter_site":"@checkmarx","twitter_misc":{"Written by":"Stephen Gates","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#article","isPartOf":{"@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/"},"author":{"name":"Stephen Gates","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/1ea38abd0315d0956c3c9c173724345b"},"headline":"On the Road to DevSecOps: Top Three Benefits of CxFlow","datePublished":"2020-07-16T07:40:41+00:00","dateModified":"2024-09-08T07:40:57+00:00","mainEntityOfPage":{"@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/"},"wordCount":978,"publisher":{"@id":"https:\/\/checkmarx.com\/#organization"},"image":{"@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage"},"thumbnailUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg","keywords":["Application Security Vulnerabilities","Automation","CxFlow","DevOps","DevSecOps","Software Developers"],"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/","url":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/","name":"On the Road to DevSecOps: Top Three Benefits of CxFlow","isPartOf":{"@id":"https:\/\/checkmarx.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage"},"image":{"@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage"},"thumbnailUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg","datePublished":"2020-07-16T07:40:41+00:00","dateModified":"2024-09-08T07:40:57+00:00","description":"This blog highlights both security and speed benefits, positioning CxFlow as a solution for accelerating secure software development.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/blog\/top-three-benefits-of-cxflow\/#primaryimage","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2020\/07\/Website-1024x512-2.jpg","width":1024,"height":512},{"@type":"WebSite","@id":"https:\/\/checkmarx.com\/#website","url":"https:\/\/checkmarx.com\/","name":"Checkmarx","description":"The world runs on code. We secure it.","publisher":{"@id":"https:\/\/checkmarx.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/checkmarx.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/checkmarx.com\/#organization","name":"Checkmarx","url":"https:\/\/checkmarx.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","width":1,"height":1,"caption":"Checkmarx"},"image":{"@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","https:\/\/x.com\/checkmarx","https:\/\/www.youtube.com\/user\/CheckmarxResearchLab","https:\/\/www.linkedin.com\/company\/checkmarx"]},{"@type":"Person","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/1ea38abd0315d0956c3c9c173724345b","name":"Stephen Gates","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/image\/","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_15.png","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_15.png","caption":"Stephen Gates"},"url":"https:\/\/checkmarx.com\/author\/stephen\/"}]}},"_links":{"self":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts\/35319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/comments?post=35319"}],"version-history":[{"count":0,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts\/35319\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media\/55576"}],"wp:attachment":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media?parent=35319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/categories?post=35319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/tags?post=35319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}