July 2022 Summaries

JFrog's latest integration of Xray with AWS Security Hub enhances cloud security by allowing vulnerabilities and compliance threats discovered through Xray's software composition analysis (SCA) to be visible and actionable within AWS's cloud security posture management service. This integration enables AWS users to centralize security administration, evaluate threats with enriched vulnerability data, and automate remediation workflows, thereby reducing the mean time to remediation (MTTR). Xray's alerts can be directed to AWS Security Hub, allowing for seamless integration regardless of where JFrog Platform deployments are hosted, and facilitating rapid responses to threats, including zero-day vulnerabilities. The integration, easily installed through the AWS Security Hub Integrations Console, allows security teams to contextualize and prioritize vulnerabilities, providing a comprehensive approach to cloud security management by integrating JFrog's extensive vulnerability data within AWS Security Hub for enhanced threat detection and mitigation.

Modern enterprises are transitioning from monolithic applications to cloud-native architectures to harness the advantages of cloud technology, enabling faster and more scalable business solutions. Cloud-native technologies, as defined by the Cloud Native Computing Foundation, empower organizations to build scalable applications in dynamic environments by utilizing components like microservices, containers, service meshes, and declarative APIs. This shift involves practices such as microservice architectures for resilience, lightweight technologies like containers for rapid deployment, automated orchestration with tools like Kubernetes, and infrastructure-as-code for scalable configuration. Key to accelerating cloud-native development are practices like universal binary repository management, which supports multiple programming languages and package types, and shift-left security, which proactively addresses vulnerabilities. Additionally, private container registries, proxying Docker Hub, and the use of Software Bill of Materials (SBOM) ensure efficient management of containerized applications while maintaining security and compliance. Tools like Helm charts and infrastructure-as-code registries further streamline the deployment and maintenance of applications in cloud environments, supported by platforms like JFrog Artifactory that offer robust registry solutions and security measures.

Shifting security left involves preventing the use of vulnerable software components in the development process as early as possible, thereby reducing remediation costs. JFrog enables this by allowing organizations to curate open-source software (OSS) components through a DevSecOps practice, where developers source approved packages from an internal proxy repository curated by the security team, rather than directly from public repositories like Maven Central or Docker Hub. JFrog's platform facilitates the creation of a front-end DMZ for these components, which acts as a trusted catalog and is managed by the security team. This DMZ utilizes JFrog Xray to continuously scan and identify vulnerabilities, automatically blocking any risky packages. It can be hosted in any cloud, offering flexibility and minimal security requirements. The curated components ensure secure and efficient software delivery, as on-prem production systems can access these trusted resources, preventing unapproved OSS components from entering production builds. This approach not only isolates production environments from untrusted networks but also protects against malicious attacks, providing a cloud-nimble solution that interconnects various JFrog deployments.

The JFrog DevOps Platform app for Microsoft Teams enhances collaboration and real-time visibility for software development teams by integrating key notifications and actions from JFrog Artifactory, JFrog Xray, and JFrog Distribution directly into the Teams environment. This integration allows developers, security managers, and production managers to track security vulnerabilities, license compliance issues, and build promotions, among other critical events, within their software pipelines, thus ensuring both speed and safety in software development. Through Teams, users receive interactive notifications that allow them to manage actions like ignoring violations, checking artifacts, and downloading components, facilitating more efficient communication and response to DevSecOps events. The integration supports cloud-based JFrog Platform versions with Artifactory 7.27 and above, providing an accessible solution for teams to keep their development efforts on track and maintain production-quality releases.

Developers seeking to create software for multiple platforms while maintaining quality and user experience can benefit from using Dart and Flutter, which are gaining popularity due to their ease of use and open-source nature. Dart, developed by Google, is a programming language designed for web and mobile app client development, enabling the creation of server and desktop applications as well. Flutter, a software development kit (SDK), allows developers to build applications for Android, iOS, and the web from a single codebase, offering a fast development experience. The text provides a detailed example of creating a simple Flutter application, including a JFrog security vulnerability card widget, and discusses how this can be shared using JFrog Artifactory as a binary repository manager. Through a series of steps, the document explains how developers can create, upload, and deploy their packages, thus facilitating sharing and reuse within the development community.