Combine safety into CI/CD with the Trivy scanner

Assaults on cloud-native infrastructures are on the rise. Analysis over a six-month interval in 2021 reveals a 26% improve in assaults on container environments over the earlier six months. Malicious actors are concentrating on the auto-build course of, packing the payloads, utilizing rootkits, and compromising misconfigured APIs—typically inside lower than an hour from setup.

Automating vulnerability scanning into improvement processes can scale back the probability of profitable assaults and assist shield containerized workloads. One of many main instruments that permits that is Aqua Safety’s Trivy, an easy-to-use open supply vulnerability scanner that helps groups “shift left” to include safety into the construct pipeline. 

Since its inception just some years in the past, Trivy has gained widespread reputation and broad help for its easy method and complete vulnerability monitoring throughout each OS packages and language-specific dependencies. The Cloud Native Computing Basis’s finish consumer group chosen Trivy as a prime devsecops software for the 2021 CNCF Finish Consumer Know-how Radar. Trivy has been adopted by many main cloud-native platforms and software program suppliers, together with Litmus, Kyverno, Istio, and ExternalDNS; it’s the default scanner for Harbor, GitLab, and Artifact Hub; and Microsoft Azure Defender’s CI/CD scanning is powered by Trivy.

Trivy has developed an important deal since its creation, and our deal with simplicity and effectiveness makes it a essential software inside any developer’s toolkit. On this article, I’d prefer to stroll you thru how Trivy integrates safety into the construct course of, share some latest developments, and clarify how Trivy matches into the broader Aqua Safety open supply ecosystem for securing the complete life cycle of cloud-native purposes. 

How Trivy works

The cloud-native safety journey begins with gaining visibility into vulnerabilities that exist in code. Figuring out and mitigating points within the improvement stage reduces the assault floor and eliminates danger. For cloud-native purposes, this includes scanning photos and features as they’re being constructed, to detect points early and permit for fast remediation, in addition to repeatedly scanning registries to account for newly found vulnerabilities.

Trivy permits devops groups to arrange and begin scanning as quick as improvement requires. Deployment and integration into the CI/CD pipeline is so simple as downloading and putting in the binary. Trivy may be built-in into CI instruments, akin to Travis CI, CircleCI, and GitLab CI. Trivy may be set to fail the job run if a vulnerability is discovered. Trivy can also be accessible as a GitHub Motion, which permits straightforward integration with GitHub code scanning. Builders can construct container picture scanning into their GitHub Actions workflow to search out and eradicate vulnerabilities earlier than they attain manufacturing.

Aqua Safety

Aqua Safety

Not like different open supply scanners, Trivy offers complete visibility throughout working system packages and programming language packages. It fetches vulnerability knowledge quicker than different instruments, so scanning takes seconds, and demanding CVEs may be filtered instantly within the command line. 

Aqua Safety

Trivy has a compact database, with auto-update capabilities that don’t require exterior middleware or database dependencies. Trivy will robotically hold the database up-to-date by downloading the most recent pre-built model from GitHub. This permits the software to be extraordinarily quick and environment friendly. The software offers outcomes for fastened and unfixed vulnerabilities, and low false positives for working methods akin to Alpine Linux.

Latest Trivy developments

Trivy was developed with a robust emphasis on usability, efficiency, and efficacy, and the developments remodeled the previous few years have supported these foundational ideas. We’ve added capabilities that assist devops groups and their processes, whereas guaranteeing that the software stays extremely efficient and simple to make use of. 

Along with container picture scanning, Trivy now helps scanning for file methods and Git repositories. These capabilities assist to strengthen container safety greatest practices, akin to sustaining a set of base photos which are well-maintained and safe. For example, Aqua Safety lately pulled a pattern of official Docker photos utilizing the Docker Hub API after which scanned these photos for vulnerabilities. We discovered that many photos had been working unsupported working methods, together with older variations of Debian or Alpine, and that in some circumstances, the official photos had been not supported. 

Aqua Safety

We additionally discovered photos with massive numbers of unpatched vulnerabilities however no formal deprecation info. This consists of Nuxeo (186), Backdrop (173), Kaazing Gateway (95), and CentOS (86). The final of those, CentOS, had been downloaded greater than seven million occasions between July 29 and August 10, 2021. Having an efficient scanner like Trivy can be certain that improvement groups are utilizing well-maintained and safe base photos, decreasing the danger of exploitation.

Trivy now additionally works as a shopper and server. These options are straightforward to arrange and begin utilizing. An official Helm chart is offered, in order that the Trivy server may be put in in a Kubernetes cluster, and Redis is supported as a cache again finish for scale.

Our most up-to-date addition is the power to scan configuration recordsdata of infrastructure-as-code (IaC) instruments akin to Kubernetes, Docker, and Terraform, to detect misconfigurations. Trivy can parse generally used cloud-native codecs after which apply a algorithm that encode good safety practices. This enables for fast identification of attainable safety points and alternatives for hardening software artifacts, akin to Dockerfiles and Kubernetes manifests.

Terraform scanning leverages the superb ruleset from the Tfsec mission, which lately joined the Aqua open supply software program ecosystem. There are units of checks overlaying the three main cloud suppliers, and it’s attainable to make use of the Tfsec rulebase in a number of places, serving to to make sure constant coverage software by means of the event course of.

Future Trivy enhancements will add IaC scanning help for Ansible, CloudFormation, and Helm. Different updates will add Trivy help for the lately launched AlmaLinux, Rocky Linux, and different new working methods, plus broaden help for programming languages and introduce help for software program invoice of fabric (SBOM). 

An open supply ecosystem for cloud-native safety

Trivy is a part of Aqua’s portfolio of open supply cloud-native safety tasks. We see open supply as a method to democratize safety and likewise educate engineering, safety, and devops groups by means of accessible instruments, decreasing the abilities hole and automating safety controls into cloud-native pipelines nicely earlier than purposes go into manufacturing. Our different open supply tasks embrace:

• Tracee: Detects suspicious behaviors at runtime utilizing eBPF tracing and research-driven behavioral signatures.
• Tfsec: Supplies Terraform scanning with a run-anywhere design that ensures that vulnerabilities are recognized earlier than deployment, no matter complexity.
• Starboard: A Kubernetes-native safety toolkit for scanning photos utilized by workloads in a Kubernetes cluster.
• Kube-bench: Winner of a 2018 InfoWorld Bossie Award, Kube-bench robotically determines whether or not Kubernetes is configured in accordance with suggestions within the CIS Kubernetes benchmark.
• Kube-hunter: A penetration testing software that searches for weaknesses in Kubernetes clusters, so directors, operators, and safety groups can establish and tackle any points earlier than attackers are in a position to exploit them.
• CloudSploit: Supplies cloud safety posture administration (CSPM), evaluating cloud account and repair configurations in opposition to safety greatest practices.
• Appshield: A group of insurance policies for detecting misconfigurations, particularly safety points, in configuration recordsdata and infrastructure-as-code definitions.

These tasks combine with Aqua’s Cloud Native Software Safety Platform and with many generally used devops ecosystem instruments to assist drive quicker adoption of cloud-native applied sciences and processes, whereas sustaining safety. They’re supported by Aqua’s open supply group, which operates individually from industrial engineering. We imagine this enables us to maintain our dedication to offering long-term help, creating in-demand options with high-quality code, and frequently contributing to different tasks inside the open supply group. 

Teppei Fukuda is an open supply software program engineer at Aqua Safety.

—

New Tech Discussion board offers a venue to discover and focus on rising enterprise know-how in unprecedented depth and breadth. The choice is subjective, primarily based on our decide of the applied sciences we imagine to be necessary and of biggest curiosity to InfoWorld readers. InfoWorld doesn’t settle for advertising and marketing collateral for publication and reserves the appropriate to edit all contributed content material. Ship all inquiries to newtechforum@infoworld.com.