Connected Research - KDD Code Security Tools

DACI Decision

Status	NOT STARTED
Impact	This decision affects the level of security protection built into the application code developed and deployed by the Lab Booster team.
Driver	KRONTIRAS-ext, Pavlos
Approver	KRONTIRAS-ext, Pavlos
Contributors
Informed
Due date
Outcome

Tips and info

Recommendations

Contributors

Contributors: I am seeking the right people to get involved in the decision. Add your comments to this page, let's get the conversation started.

Please add:

The people directly impacted by this so we can include them.
Any references to previous work and investigations that we can leverage.
Any constraints and challenges we need to consider to make this decision and following action plan.

Impact rating

Here's an example you can use as a guide.

Decision characteristics
The decision will have a material impact on the customer experience OR will significantly impact the roadmap OR will adversely disrupt an internal business process.	HIGH
The decision will involve a less than material change to customer experience OR will impact the roadmap OR will impact an existing internal business process	MEDIUM
All other decisions	LOW

Background

The application code developed for Lab Booster (DataLab) includes 3rd party libraries that are widely used in the industry but may still include vulnerabilities. Also the business logic within the code along with the application design may itself create vulnerabilities that could expose the Syensqo systems and data to potential bad actors. Including security tools as part of the application code build, and the development practice itself can significantly reduce this risk.

Current state

No standardized security tools are used.

Data for decision support

Options considered

	Option 1: Do nothing	Option 2: Aikido	Option 3: Snyk	Option 4: SonarQube	Option 5: HCL AppScan
Description
Rollout plan
Pros and cons		Developer-first tool Multiple integrations with IDEs and Ci/CD tools Real-time scanning during development Context-aware, AI-powered analysis, reduces false positives Easy to setup/deploy Focus on cloud-native security, especially microservices architectures. Young company (2yo)., not enough track record SaaS only AI reduces false positives but accuracy is unknown SAST only, no DAST capability
Risks		New product and community knowledge/skills/support may be limited AI classification may not be very accurate
Estimated cost and effort		From € 299/mo for 10 users https://www.aikido.dev/pricing