StackHawk

StackHawk typical implementation process:

1. Integration with CI/CD Workflows: StackHawk is built to be integrated into continuous integration and continuous deployment (CI/CD) workflows. This allows for automated security testing to be part of the everyday software testing process.

2. Local and Continuous Testing: Developers can test their applications and APIs locally and continuously within their CI/CD workflows. This helps in improving the quality and reducing the time to release.

3. Utilization of Existing Tools: StackHawk can be integrated with existing developer tools and workflows, including GitHub, JIRA, AzureDevOps, Snyk, AWS, and more. This ensures that the implementation process does not disrupt existing processes.

4. Real-Time Results and Alerts: The software provides real-time results and alerts, enabling faster identification and fixing of security issues.

5. Triage and Prioritization: The software categorizes findings based on their severity and impact, allowing teams to focus on and fix the most critical vulnerabilities first.

StackHawk customization process:

1. Complete API Coverage: The software provides customized API security testing to ensure complete and accurate coverage across various types of APIs, including REST, GraphQL, gRPC, and SOAP.

2. Fine-Tune Scanning: StackHawk allows for fine-tuning of scanning processes to identify and prioritize actionable insights, reducing noise and focusing on the most critical vulnerabilities.

3. Interoperability with Existing Tools: The software is designed to work with a wide range of existing developer tools and workflows, making it adaptable to different business environments.

4. Proactive Security Testing: StackHawk enables proactive API and application security testing, helping businesses accelerate the delivery of quality, security-tested releases while minimizing business disruptions.

StackHawk training and supports:

1. Documentation and Tutorials: Comprehensive documentation and tutorials are available to guide users through the setup and usage of StackHawk. This includes technical onboarding guides and sample applications for practice.

2. Workshops and Webinars: StackHawk conducts technical workshops and webinars to provide hands-on training and deeper insights into using the platform effectively.

3. Customer Support: StackHawk provides email-based support, chat, and Slack-based support. For Enterprise users, there is also dedicated Slack-based support and premier Zoom support.

4. Integration Support: StackHawk integrates with various tools like GitHub, Jira, Azure DevOps, and more, with detailed guides on how to set up and use these integrations.

StackHawk security measures:

1. Encryption:

   • Sensitive customer data is encrypted at rest using AES-256.

   • Data in transmission is encrypted with at least TLS 1.2.

2. Vulnerability Management:

   • Internal scanning is conducted regularly against StackHawk's infrastructure.

   • External penetration testing is performed by third parties at least annually.

3. Logging and Monitoring:

   • Systems and networks are monitored for security incidents, health abnormalities, and availability

     .

   • The production cluster is monitored by Guard Duty and AWS WAF.

4. Incident Response: StackHawk has a formal incident management framework supported by senior engineering leadership and the Information Security team. Customers are informed of any security incidents impacting their data within 72 hours of discovery.

1. Disaster Recovery and Business Continuity:

   • Redundancy and hot-standby setups are in place for AWS SQL deployments, with data synchronized between AWS data centers.

   • Daily database snapshots are taken and stored for a minimum of 90 days.

2. Audits and Certifications: StackHawk undergoes an annual ISAE3402 SOC2 Type II audit to verify the effectiveness of its information security practices.

3. Employee Controls:

   • Employees undergo background checks and are required to sign confidentiality clauses.

   • Security awareness training is provided upon hire and throughout the year.

4. Access Control:

   • Multi-factor authentication is enforced for logins.

   • Administrative activities are logged and retained for at least 90 days.

   • Access to tools is provisioned on a role basis according to the principles of least privilege, with annual access reviews.

StackHawk data ownership and portability:

1. Data Ownership: Users retainownership ofthe personalinformation theyprovide to StackHawk. This includesbusiness andpersonal contactinformation, registrationinformation, scanresults, andfeedback or correspondence.

2. Data Portability: StackHawk allows usersto access, update, and transfertheir personaldata. The datais provided ina commonly used, machine-readable format, ensuring thatusers can easilymove their dataacross differentservices if needed.

StackHawk scalability:

1. Subscription Plans: StackHawk providesdifferent subscriptionplans, includingthe Pro Planand EnterprisePlan, which canbe adjusted basedon the numberof code contributors.

2. Scaling Up: Organizationscan scale upby adding morecode contributorsto their subscriptionplan. This isparticularlyuseful for growingteams that needto onboard moredevelopers andincrease theirsecurity testingcapacity.

3. Scaling Down: Similarly, organizationscan scale downby reducing thenumber of codecontributorsin their plan. This flexibilityensures thatbusinesses onlypay for whatthey need, makingit cost-effective toadjust the serviceas organizationalneeds change.

StackHawk terms and conditions:

1. Non-Cancelable andNon-Refundable Payments: All paymentobligations arenon-cancelable, andall amounts paidare non-refundable. Thisapplies to boththe initial subscriptionperiod and anyrenewals.

2. Automatic Renewal: Subscriptioncontracts renewautomaticallyeach year, unlesscanceled threemonths beforethe contractexpiry. Thisensures continuityof service unlessthe customerexplicitly optsout.

3. Scaling and Upgrades:

   • Customerscan purchaseadditional rightsand subscriptionsat any time bypaying the then-current feesfor such additions.

   • New featuresor functionsnot previouslylicensed canbe added by payingthe applicableprice.

   • Upgrades to a higherservice tiercan be made bypaying the differencebetween the currentand upgradedoffering prices.

   • Pricesfor these additionsare prorated forthe remainderof the subscriptionperiod.

4. Usage-Based Fees: If the usageof the solutionexceeds the subscriptionfees paid, StackHawk may chargethe differenceto the creditcard on fileor suspend theservice untilthe additionalfees are paid.

5. Discounts: Anydiscounts providedapply only tothe initial quantitiesordered duringthe initial subscriptionperiod. Additionalpurchases duringthe subscriptionperiod are subjectto prorated pricing.

StackHawk adhere to the following compliance standards:

1. SOC 2 Compliance:

   • StackHawk undergoes an annual ISAE3402 SOC2 Type II audit to verify the effectiveness of its information security practices.

   • The platform helps organizations achieve and maintain SOC 2 compliance by conducting vulnerability scans, remediating identified vulnerabilities, and documenting the testing process.

2. GDPR, GLBA, and PCI DSS:

   • StackHawk helps financial institutions comply with regulations such as GDPR, GLBA, and PCI DSS, including PCI 6.6, by automating security compliance checks and monitoring.

   • Continuous testing and automated reporting features help organizations maintain compliance and provide evidence during audits.

3. HIPAA: StackHawk's continuous monitoring capabilities and customizable scans help organizations meet HIPAA security requirements by proactively identifying and addressing vulnerabilities.

4. General Security Practices:

   • StackHawk employs encryption for data at rest (AES-256) and in transmission (TLS 1.2).

   • Regular internal and external security audits, including penetration tests, are conducted to ensure ongoing compliance and security.

   • The platform's governance includes monthly updates to the CEO from the Information Security & Risk team, ensuring high-level oversight of security practices.