Pipeline Vulnerability Discovery

How often do you stop to think about the safety of your development tools?

Even when these don't intentionally include malicious code, they often use libraries or modules with vulnerabilities. Either because they are linked against old or just plain deprecated versions, or even recent versions with recently discovered flaws that opened a point of attack. Moreover, if your tools are just packed with some bad configurations or too open implementation rules (such as port exposure), you are exposed to security problems, even serious ones. You can unconsciously have been working with outdated, vulnerable Javascript libraries. How can we protect us and our deliverables, and do it in a manner that does not negatively impact our release pipeline complexity, our production lifecycle length or our development costs?

The ideal solution should be completely automated. And it also needs to have bleeding edge information, so you are protected from the most recent and dangerous threats. And of course, it needs to be easily integrable with your delivery pipeline. And the icing of the cake would be that the same tool offers solutions or workarouds for found threats.

Our proposal is not only to eliminate the time invested in looking for which-component-depends-on-which-vulnerable-library, but also to save the time referred to the search for a solution. We integrate our tool into your delivery pipeline, ideally at the early stages of your project, and create an alert-response mechanism using Slack channels to keep the information flowing at top speed and to the right people. And to really excel on the ideal situation proposed above, we also add a constant monitoring process, which in the event of a positive detection -in your library and tool sets,

or on related technologies- alerts you and your team and helps you take corrective actions.

At Teracloud we strive to help companies to embrace a security-first culture, understanding that automated monitoring and experienced people are the key to guarantee that "hidden defects" unknown to the developers are found, and to obtain consistent and secure products for your customers.

Lourdes Dorado

DevSecOps Engineer

Teracloud.io

If you feel that this blogpost represents your actual needs, concerns or you just want to know more, email to our team member ben@teracloud.io.