JFrog, GitHub Join Forces for Unified Runtime Security
Finding and using “common denominators” is a term we all learned early in our education. They signify something that provides a basis for comparison or connection, whether in mathematical operations or in understanding the relationships between different individuals or entities.
DevSecOps software maker JFrog and GitHub, the world’s busiest code development platform, have determined some key common denominators that could prove to be a real plus for developers.
At SwampUp2024, JFrog’s annual DevOps and security conference, on Sept. 9, the two companies revealed that they have engineered key IP elements together to create JFrog Runtime Security, a unified dashboard view — with unusual attributes — of the project status and security posture of any IT system.
“JFrog provides visibility and traceability in runtime environments, allowing customers to ‘shift security left and right,'” CEO and co-founder Shlomi Ben Haim told The New Stack. “This capability is unique to the market, because no one else has been able to provide this level of visibility and traceability from the developer to the runtime environment.”
This combination enables developers to get an efficient high-level look at a system in order to circumvent potential vulnerabilities earlier in the software development cycle, in order to reduce risk and improve developer efficiency.
“This completes JFrog’s software supply chain security suite,” Ben Haim said. “By owning the repository data, JFrog can provide detailed traceability and faster remediation when issues are detected in the runtime environment.”
Secures Developers’ Workflows with One Platform
Specific features of this new runtime view include:
- Bidirectional code navigation and job visibility: Developers can navigate from GitHub Actions Workflows using a list of packages created under the output of the build to where it’s deposited in JFrog Artifactory and back again. This bidirectional navigation extends to software bills of materials (SBOM) packages, making software provenance and dependencies more accessible to developer teams. Additionally, a new Job summary page on GitHub provides an at-a-glance view of each project’s health and security status.
- Unified, secure single sign-on (SSO): Previously, switching effortlessly between development environments required use of tokens that could inadvertently introduce tremendous risk to an organization. The OpenID Connect (OIDC) SSO support and feature mapping establishes a trust relationship between GitHub Actions and the JFrog Platform, automating token management for identity verification, so developers can swiftly move between environments with confidence.
- Consolidated security status dashboards: A unified dashboard enables a comprehensive view of security scan results from the respective GitHub and JFrog tools, plus role permissions and identity management. By consolidating security findings into a shared GitHub dashboard, developers can address potential vulnerabilities earlier in the development cycle, saving time and reducing risk.
“Developers often don’t realize there’s an issue until something breaks; it’s only then that they can start piecing together the puzzle to find out what went wrong. Our partnership with GitHub empowers teams to navigate between code development and binary storage, enabling a more intuitive workflow,” said JFrog CTO and co-founder Yoav Landman.
“This integration is expected to ensure developers can easily connect their source code with the corresponding binaries while maintaining a consolidated view of security, so they can focus on delivering high-quality software without the worry of unseen vulnerabilities.”
According to JFrog’s 2024 Software Supply Chain State of the Union report, only 56% of companies are using both source code and binary scanning to secure their software supply chains, leaving nearly half of companies vulnerable to attacks at the binary level. This is risky because attackers are increasingly effective at finding vulnerabilities and sensitive information in binaries, Ben Haim said.
Recently, JFrog’s Security Research team discovered a token inadvertently left in a Docker container that granted full access to the Python package repository. Had this token been discovered and exploited, it would have impacted tens of millions of computer systems worldwide used for running most of today’s internet and cloud infrastructure, automation tasks, financial services and data analysis, Ben Haim said.
JFrog Joins GitHub CoPilot Program
At the SwampUp conference, JFrog also revealed its participation in GitHub’s Copilot Extensions program. The extension allows developers to use a chat feature to retrieve answers to common coding questions relevant to their JFrog and GitHub environments, eliminating the need to sift through documentation or search online forums.
