What is Vulnerability Scanning?

Overview

To effectively secure the software supply chain, DevSecOps must understand and manage vulnerabilities introduced into their systems, networks, and application infrastructure.  Vulnerability scanning plays a vital role in identifying weaknesses and flaws that could be exploited by hackers or malicious actors.

Understanding Vulnerability Scanning

Every software application can contain vulnerabilities. Fortunately, using Software Composition Analysis (SCA) tools, it’s possible to detect most open-source software (OSS) vulnerabilities before an application is deployed into production. SCA scanners can identify and analyze OSS vulnerabilities that lurk within both source code and binaries, that most developers and their managers would be unlikely to catch during standard code reviews.

The importance of vulnerability scanning in cybersecurity cannot be overstated. By regularly scanning at every stage of the software development lifecycle, organizations can proactively identify and address vulnerabilities before they can be exploited by malicious actors. This helps in mitigating the risk of data breaches, unauthorized access, and other security incidents that can have detrimental effects on customers and business results.

Features of Vulnerability Scanners

Regardless of framework, vulnerability scanning is a common and continuous function of all teams implementing a DevSecOps model. It involves identifying and assessing potential weaknesses at all points in the software development lifecycle, as well as threats based on weaknesses in the operating environment, such as cloud infrastructure. Important types of vulnerability scans that should be part of the software development process include:

Application Scanning

Typically, application scanners work by checking whether the contents of a software package match items that are known to be vulnerable based on databases that track security flaws within applications and libraries. For example, a vulnerability scanner may determine that a package includes a particular version of a software library that contains a known security bug. The scanner would flag the issue and warn developers to update the library to a more recent, secure version. Proper application security should include scanning of source code, binaries, dependencies, and configuration files at every step of the software development process.

Scanning Open-Source

Open-source software offers numerous advantages. It’s often available at no cost, easily customized, and enhanced, and using open-source components can significantly decrease application development time. The downside is that a variety of security vulnerabilities can be present in open-source code, such as coding flaws within open-source libraries or modules that might enable the execution of arbitrary code, allowing attackers to take control of an application or the system hosting it.

Open-source security risks can exist in virtually any type of open-source project. Large, prominent open-source projects like Linux and Kubernetes, which are well-managed, tend to have fewer security vulnerabilities than small, obscure projects that you may find on GitHub. Either way, there is always a risk that your open-source code will contain vulnerabilities, no matter where it originates.

Scanning Binaries

Advanced Software Composition Analysis (SCA) tools are capable of scanning both source code and application binaries to identify risky components. The ability to scan binaries gives teams visibility into not only the source code but the entire application, catching vulnerabilities that can be introduced after the development and build stages before they are deployed into production.

Container Scanning

When you create containers, it’s common to use base images, which contain various libraries and tools that you can use as the foundation of your containerized application environment. One of the most popular image repositories is Docker Hub, which hosts millions of images. While they should be scanned for known vulnerabilities, it is also important to determine whether these CVEs are exploitable or not, as according to the JFrog Security Research team, 78% of reported CVEs on the top Docker Hub images are not exploitable.

Misconfiguration Scanning

Even if the code is considered secure, misconfiguration exposuresc in some environments can become a backdoor for potential attacks. A good example is the misconfiguring of the cloud Identity and Access Management (IAM) rules that provide public access to sensitive data that may lead to breaches.

Container image scanning tools are useful for identifying vulnerable dependencies or configurations within an application package that may invite an attack. Likewise, configuration auditing tools can also be used to validate the configuration of infrastructure that hosts the applications, as opposed to the applications themselves, and in some cases on configuration files that define application settings.

Compliance Scanning

Scanning also helps DevOps and legal teams ensure that developers are complying with the software licenses that govern the open-source code they use. There are nearly 100 open-source license formats currently in use, each with different rules and terms regarding how these packages may be reused. By leveraging the proper compliance scanning tools, developers can automatically determine which licenses apply to their code and address any licensing compliance violations they may encounter. Legal and business teams can also be provided with proof of the licensing conditions and compliance.

Common Vulnerabilities Detected by Scanning

How Are Vulnerabilities Exploited?

To take advantage of a vulnerability, an attacker must first discover the vulnerability. Attackers can do this in a variety of ways. But to provide an example, one common technique for finding vulnerabilities is to run port scanning software, like the open-source tool Nmap, which can collect information about which services are running on a server or computer, and even which specific operating system is installed. With that information, the attacker can determine whether the services or operating system are subject to any known vulnerabilities.

Methods for exploiting vulnerabilities

Then, the attacker must devise a method for exploiting the vulnerability. Here again, exploit methods vary widely, but they may involve techniques like injecting malicious code into an application or bypassing access controls. Some vulnerabilities can be exploited remotely, meaning that attackers can take advantage of the security weakness over the network. Others require direct physical access to the infrastructure that hosts the vulnerable software.

If the exploit is successful, the attacker will gain the ability to perform malicious actions within the compromised application or its host system. Depending on the nature of the vulnerability, these actions could include activities like exfiltrating sensitive data, running malicious commands, planting malware, or disrupting critical services to cause problems for the business.

Are all vulnerabilities exploitable?

Not all vulnerabilities are exploitable. Some vulnerabilities can allow an attacker to gain complete control of a system, while others can only allow an attacker to read or modify data. The attack surface of a vulnerability is the number of ways that an attacker can exploit the vulnerability. Some vulnerabilities can be exploited remotely, while others can only be exploited if an attacker has physical access to the system. The availability of exploit code is also a factor in the exploitability of a vulnerability. Some vulnerabilities have publicly available exploit code, while others do not.

Best Practices for Vulnerability Scanning

Getting the most from package vulnerability scanners

Simply deploying an automated vulnerability scanner as part of your CI/CD pipeline is the first step toward staying ahead of security issues. However, teams should take additional steps to maximize their chances of finding all potential vulnerabilities within packages.

Keep builds as small as possible

The more code and dependencies you have in each build, the more difficult it can be for vulnerability scanners to unpack all the layers and detect vulnerabilities. It’s also harder to fix a security issue and rebuild if the build contains many components.

It’s a best practice to ensure that each package you create contains only the code and other resources required to deploy one facet of functionality. Resist the temptation to cram multiple components of an application into a single package.

Scan early in the development lifecycle

Applying security testing early or “shifting left” offers two main benefits:

First, vulnerabilities are easier to address earlier in the CI/CD pipeline, because you have less invested. If you wait to scan until you’ve already performed other types of tests with your builds, you’ll need to run those tests again if you detect a vulnerability and have to do a rebuild.

Second, it effectively mitigates the risk of deploying an insecure application into production.

Assess priority levels

A long list of “potential” vulnerabilities within a build isn’t very helpful if your team struggles to determine which vulnerabilities are serious enough to make the build unusable.  Avoid this problem by investing in a scanner that enables effective vulnerability risk assessment and prioritization based on an analysis of the actual security impact of each vulnerability. That way, you can easily determine which vulnerabilities are show-stoppers, and which are issues that you can ignore.

Scan packages even if you trust the source

Sometimes, the packages you use to deploy are external, and come from third-party sources. e.  In these cases it’s critical  to scan them, no matter how much you trust the source.

Invest in a comprehensive vulnerability database

Open-source package vulnerability scanners (SCA Tools) are only as effective as the vulnerability data you feed into them. If your vulnerability database doesn’t include a known security issue, your scanner can’t detect it. That’s why it’s a wise choice to invest in a vulnerability scanning solution from a DevOps security platform provider that leverages a comprehensive vulnerability database by drawing on multiple sources of threat information — including public, proprietary, and in-house security research expertise.

The JFrog Software Supply Chain Platform

The JFrog platform is the universal software supply chain solution for DevOps, Security, and MLOps. With 50+ integrations, it can integrate with and orchestrate your entire ecosystem of tools, providing automated, extendable, and secure software supply chain management. Continue to explore more topics using the Related Articles link below, or if you’re ready to give JFrog a try, then book a demo or start your free trial at your convenience.