UPDATED 09:15 EDT / JULY 12 2023

SECURITY

JFrog’s new Curation solution automates security for open-source packages

Software supply chain company JFrog Ltd. today launched JFrog Curation, an automated DevSecOps solution that checks and blocks infected open-source or third-party software packages and their dependencies before they enter a company’s development pipeline.

With a large proportion of modern software development relying heavily on open-source libraries, JFrog Curation has been designed to tackle the security risks open-source software can introduce to the development pipeline. According to the company, an estimated 90% of developers utilize open-source components when building proprietary applications and although the components accelerate project delivery, they often introduce vulnerabilities that increase the risk of software supply chain attacks.

JFrog Curation addresses these vulnerabilities head-on by integrating with the company’s Software Supply Chain Platform for centralized control and automated enforcement of security policies. The proactive approach allows for vetting and blocking potentially compromised packages before they can be integrated into a company’s software ecosystem, according to JFrog.

The new tool is claimed to be different from other tools in DevSecOps, the practice of integrating security testing at each stage of the software development process. That’s thanks to its use of binary metadata for identifying high-risk packages without requiring the download of each package for scanning. The approach provides an extra layer of security and improves efficiency in the software supply chain process.

Under the hood, JFrog Curation validates incoming software packages against a Security Research library of recorded Critical Vulnerabilities and Exposures and the National Vulnerability Database. It creates a trusted repository of software components, bridging the gap between public package repositories, developers, production and security personas. The measure not only prevents potential security breaches but also mitigates the costs and time associated with remediation efforts down the line.

“Software developers use millions of open source components to accelerate project delivery and gain a competitive edge, but this practice could be abused to inject malicious packages and vulnerabilities to the code – increasing the risk of software supply chain attacks,” Asaf Karas, chief technology office of Security at JFrog, said in a statement. “Application security must be taken seriously and looked at holistically from the point of creation through runtime on edge devices.”

Image: JFrog

A message from John Furrier, co-founder of SiliconANGLE:

Support our open free content by sharing and engaging with our content and community.

Join theCUBE Alumni Trust Network

Where Technology Leaders Connect, Share Intelligence & Create Opportunities

11.4k+  
CUBE Alumni Network
C-level and Technical
Domain Experts
15M+ 
theCUBE
Viewers
Connect with 11,413+ industry leaders from our network of tech and business leaders forming a unique trusted network effect.

SiliconANGLE Media is a recognized leader in digital media innovation serving innovative audiences and brands, bringing together cutting-edge technology, influential content, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — such as those established in Silicon Valley and the New York Stock Exchange (NYSE) — SiliconANGLE Media operates at the intersection of media, technology, and AI. .

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a powerful ecosystem of industry-leading digital media brands, with a reach of 15+ million elite tech professionals. The company’s new, proprietary theCUBE AI Video cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.