Aqua Security announces availability as integrated service for Pivotal Cloud Foundry

Aqua Security announces the general availability of Aqua Security for (PCF) as an integrated service for Pivotal Cloud Foundry (PCF). Pivotal users can now download and install the Aqua Security for PCF service from Pivotal Network, and use it to scan application or container artifacts for vulnerabilities.

Cloud-native applications

Aqua Security for PCF empowers Pivotal Cloud Foundry users to apply Aqua Security’s best practices early on in the build process to ensure that only code that complies with their organisation’s security and compliance policies is deployed. “Aqua Security provides valuable insights into IT security posture with automated security scans, threat detection, remediation, and expedited compliance processes at scale,” said Nima Badiey, Head of Technology Ecosystem at Pivotal.

“We are excited to make this integrated solution available to all Pivotal customers through the Pivotal Services Marketplace. One of the many advantages of using Pivotal to build containerised, cloud-native applications is that it presents an opportunity to improve application security, and Aqua helps Pivotal customers do that at DevOps speed.”

Vulnerability data streams

Developers and Security teams get actionable information on how to mitigate detected vulnerabilities

Aqua Security for PCF provides enterprise customers with the following capabilities:

• Automatically scan application or container artifacts for known vulnerabilities, based on an updated feed from multiple resources (e.g., public CVEs, vendor-issued, proprietary vulnerability data streams and malware lists)
• Identify unauthorised application or container artifacts based on pre-configured assurance policies that check for:
  • Authorisation
  • CVEs and score
  • Presence of hard-coded secrets
  • Presence of malware
• Add custom compliance checks to identify security and compliance risks (e.g., PII, PCI, GDPR-related data)
• Developers and Security teams get actionable information on how to mitigate detected vulnerabilities
• Users gain visibility into vulnerabilities in their application or container artifacts directly from CI/CD tools and the Aqua dashboard

Image assurance policies

The Aqua solution is easy to operate, supports more than 40 languages, including Java, Go, C++, Python, Ruby, NodeJS and others, as well as static binaries, and finds known vulnerabilities, embedded ‘secrets’, and malware. Users can integrate Aqua Security with their existing CI/CD tools for security testing as part of the build, with Active Directory/LDAP for user authentication, and with SIEM/analytics to output audit and alert data.

Users can then approve or block application or container artifacts depending on their vulnerability posture

Based on image assurance policies, users can then approve or block application or container artifacts depending on their vulnerability posture, the presence of embedded secrets, malware, and runtime configuration parameters.

Lifecycle security controls

“We are extremely excited to extend Aqua’s security capabilities to Pivotal Cloud Foundry users,” said Upesh Patel, Vice President of Business Development for Aqua Security. “Our automated lifecycle security controls enable organisations to integrate security best practices into the build process based on their compliance or corporate GRC requirements.”

At the upcoming Cloud Foundry Summit Europe 2018 in Basel, Switzerland, Aqua’s John Michealson will deliver a presentation. The session will examine how the growing adoption of containers and the availability of scalable orchestration tools (e.g., Kubernetes) are creating opportunities to develop more agile, easy-to-update applications that combine stateful and stateless modes, and why that creates very different security considerations and risk profiles.