Am I impacted by the SolarWinds breach?

Generally, there are two methods to determine if you’re impacted by the breach, and both are extremely difficult to implement: Examine every system within your enterprise to see if you currently have or previously had Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, or 2020.2 HF. Or monitor your organization's current DNS queries and mine the historic ones to determine if any DNS queries to hostnames contain the domain “avsvmcloud[.]com”.

There have been a ton of blogs written about this very topic and a lot of high-priced consultants have been hired to help you answer this question. However, there is no definite answer from the industry, yet. At best, the solution is consistent with mining a sea of logs, monitoring network traffic and the targeted software behavior. This approach is more art rather than science to say the least. More importantly, it is hardly practical, especially for large enterprises.

How can I remediate the SolarWind breached libraries/dependencies?

Of the three questions, this is the easiest, most straightforward one to answer: Remediation involves rebuilding the impacted servers and starting with a fresh updated install of SolarWinds Orion. However, the million-dollar question is: Where do you get the list of all the affected servers? Armed with the holistic knowledge from Xray’s binary interconnection database, you now know exactly which artifact is infected within your enterprise. To have full traceability of your runtime deployment, the JFrog Platform provides additional innovative technologies. JFrog Distribution’s Release Bundles, which are signed and immutable through GPG, make artifacts available just-in-time, and closest to your runtime environment across unsecured networks.

Artifactory Archives

How to Accelerate Software Delivery with Hybrid Cloud CI/CD

July 19, 2021 Mark Milinkovich | 10 min read

Are you looking for solutions to deliver rapid application development and iterations? You’re not alone. To accomplish this, many organizations are embracing cloud native containers across multiple cloud providers. The reason? This strategy reduces the risk of vendor lock-in, and helps you scale the application infrastructure horizontally. In their recent swampUP 2021 talk “Going Serverless,…

Enable Multi-Site DevOps with Federated Repositories

June 30, 2021 Gianni Truzzi | 8 min read

The days when applications were created by a small team of developers in one room are long past. Enterprise software development is now a highly collaborative endeavour of packages shared by intersecting teams across multiple sites spread across the globe. For the enterprise, JFrog Artifactory has long enabled multi-site replication through different push/pull replication topology…

Drive DevSecOps Visibility with JFrog Partner Integrations

June 23, 2021 John Peterson | 7 min read

If you need your teams to act, you need to alert them where they’re already looking. Yet yesterday’s DevOps practices demand individuals to wrangle with uncorrelated events, multiple UIs, and siloed technologies. Tomorrow’s DevOps must enable teams with: Unified Data Single Pane Dashboard Integrated Platform To DevSecOps, you’ll need to know where a vulnerable build…

How to set up a Private, Remote and Virtual Maven/Gradle Registry

June 22, 2021 Batel Zohar | 5 min read

The simplest way to manage and organize your Java dependencies is with a Maven or Gradle repository. You need reliable, secure, consistent and efficient access to your dependencies that are shared across your team, in a central location. Including a place to set up multiple registries, that work transparently with the Maven and Gradle clients.…

JFrog CloudFormation Modules Make Provisioning to AWS Easy and Secure

June 21, 2021 Shankar Hariharan | 4 min read

A routine cloud operations task should have a routine solution. That’s why we’ve just made it a lot easier to install and maintain self-hosted instances of the JFrog DevOps Platform on AWS, through AWS CloudFormation. To further simplify the effort of self-hosting Artifactory and Xray on AWS, we’ve just published a set of AWS CloudFormation…

What’s New from JFrog: Binary Lifecycle Management at Scale

May 26, 2021 Jens Eckels | 6 min read

UPDATE: JFrog’s Private Distribution Network is not available for public sale at this time. JFrog’s annual swampUp DevOps conference always brings new, exciting features to further our vision of accelerating releases through liquid software. This year was no exception, as JFrog CTO Yoav Landman and CPO Dror Bereznitsky revealed innovations for the JFrog DevOps Platform…

5 Steps to Starting DevOps with a JFrog Free Subscription

May 24, 2021 Mark Milinkovich | 7 min read

Note: The below post showcases the JFrog Platform Free Tier, which is currently limited for new sign-ups. In the meantime, we invite you to explore a fully-functional free trial. The JFrog Free subscription is a SaaS cloud offering of the JFrog DevOps Platform that provides software developers, DevOps Engineers, System Administrators and students a sandbox…

Managing Users and Groups with SCIM in the JFrog Platform

May 4, 2021 Yaniv Malka | 6 min read

When your organization becomes bigger, managing the users and groups lifecycle becomes a significant challenge. Your company grows rapidly, hiring new employees, and giving them access to more and more applications that your organization uses. This means that there are many employee-related actions that need to be taken when an employee changes their team, role,…

DevOps Visionaries to Discuss Software Innovation at swampUP 2021

April 28, 2021 JFrog Team | 3 min read

In a unique, must-see joint appearance, five CEOs at the forefront of DevOps innovation will take the virtual stage at JFrog’s swampUP 2021 conference to candidly share their insights about the future of DevOps. JFrog CEO Shlomi Ben Haim will be joined by his counterparts at fellow DevOps industry leaders Datadog, Elastic, HashiCorp, and PagerDuty…

Automatically Assess and Remediate the SolarWinds Hack

April 14, 2021 Frank Zhu | 9 min read

With software supply chain attacks on the rise, are you wondering how you can recover quickly from the recent SolarWinds breach at your company? Months after its discovery, the devastating SolarWinds hack remains a top concern for business, government and IT leaders. This destructive supply chain attack put the spotlight on software development security --…

Welcome to the JFrog Blog

Latest from Artifactory :

Taking a GenAI Project to Production