Misconfigurations Scans

JFrog Advanced Security goes beyond detecting CVEs, first-party SAST issues, and exposed secrets. It also identifies security misconfigurations that can leave your applications vulnerable. By scanning for misconfigurations across your infrastructure, services, and applications, JFrog Advanced Security helps you strengthen your security posture early in the development pipeline and ensures compliance at every stage.

Infrastructure as Code Scans

JFrog Advanced Security scans your Terraform files for cloud misconfigurations at different stages of the development pipeline. During development, it scans Terraform modules to catch issues early before deployment. Once the infrastructure is deployed, Terraform state files in JFrog Artifactory are scanned to ensure that cloud services remain securely configured. It supports cloud services from AWS, Azure, and GCP, enabling comprehensive coverage for all major cloud platforms.

A key differentiator of JFrog Advanced Security is its focus on real security risks in infrastructure as code scanning. Unlike common infrastructure as code tools that report many low-severity issues with little impact, JFrog Advanced Security provides detailed severity ratings so you can identify and address actual security risks.

Examples of Detected Misconfigurations

• Insufficient access restrictions to services, for example public repositories, publicly accessible clusters, globally readable, deletable, or writable buckets, admin roles in ECS services, IAM users with privileged access to all resources, or API Gateway methods that don't enforce authorization.
• Insecure use of credentials, for example hardcoded credentials.
• Weak cryptographic algorithms, for example weak cipher suites.
• Batches that run in privileged mode.
• Missing enforcement of secure communication, for example listening on HTTP or using unencrypted communication.
• Wildcard actions in Glue policies.
• Missing logging, for example CloudTrail trails with logging disabled.
• Disabled upgrades, for example an RDS database instance with minor engine upgrades disabled.
• Data at rest encryption enablement for Kinesis streams.

Services Configuration Security Scans

JFrog Advanced Security scans common open source libraries and services in your containers for misconfigurations, ensuring that services such as web servers, databases, and proxies are securely configured by default. This helps prevent vulnerabilities in essential services.

Supported Services

• Envoy
• Etcd
• Prometheus
• NGINX
• Apache

Examples of Detected Misconfigurations

• Insecure use of credentials, for example an NGINX credential in a configuration file or a credential stored insecurely.
• Missing enforcement of secure communication, for example HTTP that isn't redirected to HTTPS, TLS that isn't enforced, or an old TLS version.
• Weak cryptographic algorithms.
• An externally exposed admin interface.
• Unauthenticated access to resources.

Application Library Scans

JFrog Advanced Security detects misconfigurations and insecure usage of libraries and services within your containers. Supporting Python and Node.js, JFrog Advanced Security scans for issues like excessive privileges, insecure communication, and unsafe cryptographic operations.

Examples of Detected Issues

• Insecure use of credentials, for example insecure key storage.
• Missing enforcement of secure communication, for example HTTP that isn't redirected to HTTPS, TLS that isn't enforced, TLS certificates that aren't verified for servers in Python scripts, an old TLS version, or insecure HTTP headers.
• Weak cryptographic keys.
• Logins that aren't throttled to prevent brute-force attacks, for example Node.js logins.
• Node.js exec calls that use user-provided input.

Related Topics

• Features and Capabilities
• JFrog Xray
• Contextual Analysis of CVEs