Upvest gets depth and breadth of application testing, live in a week

The challenge

Upvest's investment API sits in front of highly sensitive customer data and changes daily under an agile model. Point-in-time human penetration tests could not reach the depth and breadth needed across hundreds of endpoints and layered business logic at the team's release speed.

What they did

Upvest adopted apisec, purpose-built for automated API validation, to run daily attacks against the latest build across a broad range of vulnerabilities and business-logic paths, with real-time updates on new risks.

The outcome

apisec was live and improving Upvest's security posture within the first week, giving the team both the depth and breadth of testing that generic scanners could not follow.

‍

About Upvest

Founded in 2017, Upvest enables businesses to build investment experiences for their end users – seamless, secure, and across international borders. Upvest’s single Investment API and digital infrastructure streamline the whole process, letting their customers focus on their core business.

The Challenge

• Daily API updates under an agile development model
• Continuous testing of hundreds of API endpoints
• Complex and layered business logic models.

Upvest has built a thriving fintech on their Investment API and supporting infrastructure. Upvest’s API sits in front of sensitive customer and end-user personal identifiable information (PII) making “security first” a critical element of the Upvest development methodology.

Sebastien Jeanquier, Upvest’s Chief Security Officer, worked alongside Upvest’s technology leaders to define and implement the security practices needed for a Secure Software Development Lifecycle (SDLC). application security is a critical aspect of the SDLC, and Jeanquier’s unique background attuned him to the requirements and challenges associated with creating a comprehensive application security program at Upvest.

Upvest’s API evolves daily under an agile development model, requiring continuous testing of dozens of API endpoints leveraging complex and layered business logic models. Jeanquier has a long career in cybersecurity and served as head of penetration testing advisory and services to top-tier global clients across multiple industries including Financial Services. Based on his offensive security expertise, Jeanquier knew that achieving the breadth and depth of testing necessary to expose vulnerabilities at the speed of their development team was not possible with point-in-time human penetration tests.

The Solution

Unlike other pen testing solutions on the market, apisec was the only solution purpose-built for automated application security testing. With APIsec, the Upvest security team found the technology they needed to automate penetration tests for their API against a broad range of security vulnerabilities.

The apisec solution runs every day against the latest build of Upvest’s API, ensuring that known security vulnerabilities can be flagged and addressed before they impact their customers’ use of the API. The real-time updates on risks and issues have been vital in maintaining the security of Upvest’s services.  

The Results

Coverage

It was very important for me that we weren't just scratching the surface of security by trying to throw a dumb scanner at a bunch of endpoints and failing in a bunch of cases because it's not able to follow the business logic of different paths. With apisec, Upvest has both the depth and breadth of testing on the basis of a variety of logic within the API itself."

Responsiveness

"As with any API security testing, some portion is going to be unique to each client’s technical environment and the business logic of the API itself. We were thrilled with apisec's ability to auto-discover and build the majority of our test cases based upon our rigorous API documentation, and the solution’s flexibility to allow us to further refine and customize our test scenarios over time.”

Speed to Value

"One unique aspect of Upvest is our approach to secure authentication within our API that requires HTTP signing of every request. The majority of scanners simply can not accommodate our complex authentication model. apisec was able to work with our team to have the solution running and improving our security posture within the first week."

‍