BHG Financial, LLC

“Cloud security investment is paramount at BHG Financial. We build our own customer facing apps, so it's critical that we protect their data from malicious actors. Dazz helps the security team safely grow the business, while keeping developers doing what they do best - coding.”

Fred Hamilton , CISO of BHG Financial

Company

BHG Financial, LLC

Annual Revenue
Environments

Azure

Challenges

- Pipeline visualization

- Disparate risk management

- Inconsistent cloud governance

Results

- Improved MTTR for critical issues

- Decreased MTTR to alerts being resolved same day

- Streamlined process of finding owners for fixes

About the customer

BHG Financial, LLC is a leading provider of lending, and risk and regulatory management services. The company also provides private equity and venture capital valuation processes.

The environment

The BHG engineering team develops dozens of applications in a fast-moving, cloud-based CI/CD pipeline process. They have mostly standardized on Azure, but have a few projects on-premises for which they use code repository. They use Azure DevOps, Pipelines, and ACR for their code repository and to build, test, and deploy their software, as well as Terraform to define their infrastructure.

Efforts to secure development

The company’s security program includes monitoring its software development lifecycle (SDLC). They have mostly standardized on Azure, but have a few projects on-premises for which they use an internal code repository. They use Azure DevOps, Pipelines, and ACR for their code repository and to build, test, and deploy their software, as well as automation tools to define their infrastructure.


The challenges:

As their cloud development efforts grew, the team began to experience an unsustainable increase in alert noise and inability to address risk in a unified, efficient way. Specifically:

1. Pipeline visualization

The company generated many thousands of alerts based on vulnerabilities and misconfigurations in their software pipelines. Many of these were duplicates, often from detecting the same issue in multiple stages of development, such as QA, staging, and production. This meant that just a handful of root causes could mushroom into hundreds of alerts.

2. Risk unification

The team struggled to get a unified view of their risk. With multiple tools, each detecting issues in a slightly different way and with no way to connect those detections to the resources in the pipeline, it was impossible to gather, analyze, and prioritize the alerts and make them actionable for developers without significant manual effort.

3. Cloud governance

The team found that not all of their code repositories were being monitored as part of their SCA program, which meant they weren’t getting the entire benefit of a “shift left” security stance. Beyond pipeline coverage, the team also wanted to shore up secrets in code to prevent inadvertent data exposures.

The solution: Dazz

To address these issues, the company invested in the Dazz Unified Remediation Platform. With a simple API-based integration, the team connected Dazz to the company’s cloud repositories and detection tools to map its code-to-cloud development pipelines. In a single pane of glass, Dazz showed them all of their cloud development resources and how they were integrated, uncovered un-monitored pipelines, and sussed out secrets in code.

The Dazz Smart Root Cause Engine reduced the alert noise to a fraction of root causes, including mapping 34% of all cloud misconfigurations to just 20 root causes, and tracing 45 misconfiguration alerts in Azure Cloud Defender back to a single Terraform module.

The team took advantage of the ability to map user access and permissions between their directory service and Dazz, as well as automatically find and connect code owners to their projects they work on. By establishing these relationships in Dazz, the team is now able to facilitate efficient remediation of root causes, leading to a sustainable, developer-driven cloud security process.

  • Discover - Understand the deployment process from code to cloud, unify cloud risk from all tools, and identify architecture gaps.
  • Reduce - Clean up the noise: deduplicate and prioritize CVEs and misconfigurations based on their unique root causes, and automatically find their owners.
  • Fix - Concise, contextual, and actionable process for remediation, from detection to deployment.

What's next?

The company security team is using Dazz as its central point of truth for its own work and for reporting across security architecture and business units. Next steps will be to use Dazz workflows to enable self-service remediation.

"Our dazz investment choice was easy. From poc to sales to implementation it has been a very smooth process."

Fred Hamilton , CISO of BHG Financial

Results summary

Improved MTTR
for critical issues

Increased pipeline
monitoring coverage

Streamlined process
of finding owners for fixes

See Dazz for  yourself.

Get a demo