JFrog Launches Code-to-Runtime Security for Supply Chain Protection
Hackers are always searching for any soft spot they can find in a system to compromise it. Those deficiencies can surface at any stage of the software development cycle, from inception to deployment.
JFrog, which makes the JFrog Software Supply Chain Platform, on Sept. 10 at the SwampUp2024 conference unveiled new capabilities to insert security at every stage of the software development process. JFrog claims developers can save time by automating several DevSecOps tasks while increasing enterprises’ security postures needed for modern application development — particularly in cloud-native environments.
In cloud environments, end-to-end security is important for protecting applications and workloads from potential threats during operation. Recent findings from Kaspersky indicate that 85% of organizations utilizing container development methods faced security breaches last year, with 32% of these incidents occurring during runtime — highlighting the need for improved visibility and proactive security measures.
By automating security for micro-applications that run in containers, JFrog Runtime security addresses the unique security and compliance needs of cloud-native environments.
Shift Left, Shift Right
“As organizations continue shifting left in an effort to defend against today’s increasing threat landscape, it’s also putting more work on developers and DevOps teams,” Eyal Dyment, JFrog vice president of security products, said. “Companies can help alleviate that burden by enabling DevOps and platform engineers with an integrated platform that streamlines development and security processes from left — with curation and secure model scanning — to right with JFrog Runtime, to help scale trusted software delivery.”
By owning the repository data, JFrog claims to provide detailed traceability and faster remediation when issues are detected in the runtime environment, CEO and co-founder Shlomi Ben Haim told The New Stack. “This capability is unique to the market, because no one else has been able to provide this level of visibility and traceability from the developer to the runtime environment,” he said.
JFrog Runtime empowers users to track and manage packages from various origins, organize repositories by environment types, and activate Xray policies, ultimately fortifying security from code to runtime. As part of the JFrog platform, Runtime also addresses the visibility and alignment gaps among teams, optimizing version control and package development, while ensuring that R&D, DevOps and security teams can collaborate efficiently.
Key Features of JFrog Runtime
Key features and benefits of JFrog Runtime include:
- Real-time vulnerability visibility: Offers immediate insights into vulnerabilities within your runtime environment.
- Accelerated triage and prioritization: Streamlines the identification and prioritization of security incidents based on their business impact.
- Reduced risk through exposure management: Quickly identifies the source and ownership of vulnerable packages, enabling faster risk mitigation.
- Protection for cloud-based workloads: Safeguards applications from data breaches and unauthorized access, with ongoing monitoring for threats that emerge post-deployment, such as malware attacks and privilege escalation.
- Comprehensive analytics for Kubernetes clusters: Enables continuous runtime environment evaluation and real-time vulnerability detection to accurately identify workloads and containers, aligning them with their corresponding processes and files within JFrog Artifactory.
- Centralized incident awareness: Maintains a consolidated view of your runtime environment to facilitate accurate incident identification and response.
JFrog and GitHub, the world’s busiest code development platform, also revealed at the SwampUp event that they have created JFrog Runtime Security, a unified dashboard view — with unusual attributes — of the project status and security posture of any IT system. This is all part of the revamped JFrog platform.
