Interview with Balazs Fejes, CTO of EPAM Systems
by Mirko Zorz - HNS Chief Editor - Tuesday, 16 January 2007.
Balazs Fejes joined EPAM Systems in 2004, when Fathom Technology merged with EPAM Systems. Prior to co-founding Fathom Technology Mr. Fejes was a chief software architect/line manager with Microsoft Great Plains (Microsoft Business Solutions).

He has won numerous awards for programming excellence and has previous experience working in the US and Russia.

In this interview, Mr. Fejes discusses the security implications of outsourcing, privacy breaches and compliance laws.

What is the outsourcing industry neglecting or ignoring in terms of security? What areas need more work?

Everybody started to focus on getting various certificates, proving that they comply with security standards, this is just half the story, focusing on how you work and how you create your deliverables, but what people overlook is the security of the actual code which has been developed. Many projects today overlook the importance of proper threat analysis and secure code development standards. Or they claim they follow those, but never really check into it or audit for it. Due to the currently increasing pressure to deliver solutions cheaper and faster, this is one area which is regularly cut from the today’s projects.

EPAM has dedicated staff for auditing the code which we deliver to try to address any architectural security weaknesses and adherence to the secure coding best practices, we are doing it continuously using code analysis tools, tuned for secure coding, and regular peer reviews.

One critical aspect of IP protection, very much overlooked today, that is whether the source code created by the engineers, is really a genuine product or not. The abundance of various open source projects and the search engines indexing them like Google’s Code Search or Krugle, tempts engineers to take code from the these projects and use them, not understanding that open source doesn’t mean free. Most outsourcing companies do not have proper control over this; do not ensure the safety of their clients from license infringements.

EPAM employs rather sophisticated release and scanning processes to ensure that the code we deliver does not contain license infringements and we comply with the licensing terms required by our clients, ensuring it is part of our continuous integration approach, comparing the code created by our developers with millions of projects.

During the past year we've heard several stories of privacy breaches related to poorly implemented security policies and practices in outsourcing companies. How do you manage the complex security issues?

EPAM believes that the key to manage complex security and compliance issues is automation, implementation of the security policies and practices on the infrastructure level, and building your security infrastructure based on your engagement model. Our security infrastructure is centered on project membership, controlling access to:
  • source code repository
  • project management system
  • flle shares
  • distribution lists
  • knowledge database
  • development and test servers
  • physical access to areas
To further ensure segregation of projects, EPAM implements the security on the network level too by constructing and segregating the network to project specific VLANs.

Plus we make sure we aid our physical security with the right level of technology, such as proximity cards, CCTVs, fire and other environment sensors, and making sure all these are in sync with our projects, and customer requirements. EPAM has security setup templates to cover the various needs of our customers, and we are making sure that every time a project gets imitated, we apply the necessary template for aiding it by the infrastructure.


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th