WhiteSource, now Mend, unveils automated remediation to improve security

Utility safety vendor, WhiteSource, right now introduced a brand new platform that provides remediation for each open-source software program and customized code. Along with this, the corporate introduced a brand new model id and identify — Mend. The corporate famous the rebranding represents its dedication to eradicating the silos that at present exist between safety and improvement groups.

When WhiteSource bought Xantizer and DefenseCode, VentureBeat beforehand lined the launch of this platform. Mend (previously WhiteSource) debuted the WhiteSource static software safety testing (SAST) answer earlier this 12 months and anticipated to mix it with software program composition evaluation (SCA) within the second half of the 12 months. This announcement now marks the launch of the platform and its SAST in addition to SCA capabilities.

Devops adoption rising assault floor

Cybercriminals understand that the applying assault floor is growing on account of devops adoption. Attackers have found that as a result of networks are safe, the functions are sometimes the weakest hyperlinks, as most are not properly secured. Due to the rising variety of vulnerabilities left by outdated software safety options, functions have gotten extra interesting targets. One report discovered that 99.7% of functions have a minimum of one vulnerability.

Added to that is the rising strain on organizations to ship software program at a quicker tempo. Organizations are below rising strain to safeguard functions whereas additionally delivering software program extra shortly. And based on one other study, resulting from time constraints, over half of organizations routinely launch dangerous code into manufacturing of their software safety initiatives.

Mend, based on Rami Sass, the corporate’s cofounder and CEO, “breaks the tradeoff between safety and improvement supply schedules” by offering an answer that “automates the lower of the software program assault floor whereas decreasing nearly all of the burden of software safety.” He famous that this permits improvement groups to supply high-quality, safe code extra shortly.

An environment friendly methodology to handle software program vulnerabilities should embody the usage of safety testing instruments to search out each weaknesses in proprietary code utilizing SAST and vulnerabilities in open-source code utilizing SCA. Mend claims its platform is now the primary to routinely discover and repair software safety holes involving each open-source and customized code. The corporate says it combines automated remediation for SAST with Mend’s present potential to routinely remediate SCA.

SAST is a well-liked software safety software that searches an software’s supply, binary, or byte code for vulnerabilities and fixes them. SCA, however, is an software safety method that enables improvement groups to trace and analyze any open-source element that’s launched right into a mission shortly. 

Whereas SAST options look at an software from the “inside out” and don’t require a operating system to scan, SCA acts like a gatekeeper, checking for unlocked gates and open home windows that would enable an intruder entry. SCA examines supply code for bundle managers, container photographs and binary information and information them in a Invoice of Supplies (BOM), which is a catalog of recognized vulnerabilities.

SQL injections, server-side injections and command injections are just some of the vulnerabilities that may be exploited. Whereas it’s unusual to search out software program that features each SAST and SCA, a study discovered that software program safety applications that embody each SAST and SCA are extra thorough and organizations that use it obtain higher outcomes. 

Mend claims that its software safety platform gives computerized remediation for each open-source and customized code, providing actual patches for every line of code, permitting any degree of developer to effortlessly produce high quality, safe code.

Till now, software safety options might solely supply coaching supplies and examples to assist builders discover solutions to every safety problem they encountered. In keeping with a Synopsys research, this inefficient process requires builders to decide on between safety and assembly deadlines. 

Mend, however, claims that its platform gives automated remediation for SCA and SAST, which is offered instantly within the developer’s repository for simple integration into the developer course of. “Builders don’t need to forgo safety for pace,” the corporate said.

Provide chain defender integration 

As a part of its announcement, Mend mentioned its provide chain defender, previously often known as WhiteSource Diffend, will probably be built-in with its present Jfrog Artifactory plugin. 

In cybersecurity, {hardware} and software program, cloud or native storage and distribution mechanisms are all a part of the provision chain. Provide chain assaults, also referred to as third-party assaults, have emerged as a brand new sort of hazard focusing on builders and suppliers and these attacks are more and more on the rise. 

Fashionable improvement pipelines are sophisticated automated environments with a variety of steady integration (CI) and steady supply (CD) instruments. For devops groups, CI/CD is a greatest apply that enables software program improvement groups to concentrate on satisfying enterprise wants whereas additionally making certain code high quality and safety. Nevertheless, open-source code is incessantly repurposed by developers and every software program mission might rely solely on lots of of open-source tasks. Because of this, the software program provide chain has turn into a preferred goal for hackers.

Provide chain assaults have been rising in quantity and complexity for the reason that SolarWinds breaches. A report reveals that offer chain assaults have elevated by 430%. On condition that not each assault is reported or detected, the true quantity is probably going increased. Malicious attackers have switched to straightforward targets and found extra modern methods to make their efforts hardest to detect and probably to succeed in fascinating targets. 

Provide chain assaults go away firms significantly weak as a result of they can be utilized to hold out any sort of cyberattack, equivalent to a knowledge breach, wherein non-public, delicate, or protected materials is duplicated, accessed, acquired, or distributed to be used by an unauthorized particular person. 

Mend says its provide chain defender is an answer that detects and blocks this malicious open-source software program with the Mend platform plugin for the Artifactory registry.

The corporate says that through the use of JFrog Artifactory as a non-public repository supervisor, enterprise prospects could possibly forestall dangerous open-source software program from coming into their code base. In keeping with Mend’s press launch, firms might safeguard all tasks involving JavaScript or Ruby with a centralized coverage enforcement and auditing level by putting in provide chain defender as soon as. 

For a unified view contained in the builders’ native setting, the corporate says all outcomes for open-source and customized code are displayed in a customized or third-party code repository. 

In keeping with Josh Johnson, supervisor of options structure at Defy Safety, the applying safety trade has largely targeting vulnerability identification and administration.

“As a Mend companion, we’re thrilled for the corporate to proceed its dedication to fixing code-based safety issues with automated remediation below this new model. Defy Safety is worked up to see Mend broaden their automation capabilities for fixing safety vulnerabilities,” Johnson mentioned.