DEVOPSdigest

Aqua Security announced the general availability of Aqua Security for (PCF) as an integrated service for Pivotal Cloud Foundry (PCF).

Pivotal users can now download and install the Aqua Security for PCF service from Pivotal Network, and use it to scan application or container artifacts for vulnerabilities. Aqua Security for PCF empowers Pivotal Cloud Foundry users to apply Aqua Security's best practices early on in the build process to ensure that only code that complies with their organization's security and compliance policies is deployed.

"Aqua Security provides valuable insights into IT security posture with automated security scans, threat detection, remediation, and expedited compliance processes at scale," said Nima Badiey, Head of Technology Ecosystem at Pivotal. "We are excited to make this integrated solution available to all Pivotal customers through the Pivotal Services Marketplace. One of the many advantages of using Pivotal to build containerized, cloud-native applications is that it presents an opportunity to improve application security, and Aqua helps Pivotal customers do that at DevOps speed."

Aqua Security for PCF provides enterprise customers with the following capabilities:

- Automatically scan application or container artifacts for known vulnerabilities, based on an updated feed from multiple resources (e.g., public CVEs, vendor-issued, proprietary vulnerability data streams and malware lists)

- Identify unauthorized application or container artifacts based on pre-configured assurance policies that check for:
Authorization
CVEs and score
Presence of hard-coded secrets
Presence of malware

- Add custom compliance checks to identify security and compliance risks (e.g., PII, PCI, GDPR-related data)

- Developers and Security teams get actionable information on how to mitigate detected vulnerabilities

- Users gain visibility into vulnerabilities in their application or container artifacts directly from CI/CD tools and the Aqua dashboard

The Aqua solution is easy to operate, supports more than 40 languages, including Java, Go, C++, Python, Ruby, NodeJS and others, as well as static binaries, and finds known vulnerabilities, embedded "secrets", and malware. Users can integrate Aqua Security with their existing CI/CD tools for security testing as part of the build, with Active Directory/LDAP for user authentication, and with SIEM/analytics to output audit and alert data. Based on image assurance policies, users can then approve or block application or container artifacts depending on their vulnerability posture, the presence of embedded secrets, malware, and runtime configuration parameters.