Join gaming leaders on the web at GamesBeat Summit Next this upcoming November 9-10. Learn more about what comes next.
Let the OSS Enterprise newsletter guide your open source journey! Sign up right here.
Deepfence, a cloud-native safety observability platform applied by firms such as Amyris, Flexport, and Harness, has open-sourced a tool that automatically finds, maps, and ranks application vulnerabilities across environments.
Founded in 2017, Deepfence focuses chiefly on safeguarding cloud-native workloads, spanning serverless, Kubernetes, container, and multi-cloud deployments. With Kubernetes, for instance, firms can deploy Deepfence to analyze network targeted traffic, file-technique integrity, operating processes, and more, and it functions natively with managed Kubernetes services which includes OpenShift, Google GKE, and Amazon EKS.
While Deepfence has normally presented an enterprise edition and a neighborhood incarnation recognized as ThreatMapper, the latter of these is getting released beneath an open supply license from tomorrow (October 14).
The announcement comes as computer software provide chain attacks explode, with “upstream” open supply elements typically in the firing line. Countless organizations, from government agencies to corporations, have been hit by targeted computer software provide chain attacks in the previous year, top President Biden to situation an executive order outlining measures to combat the threats, although “big tech” has also upped their investments in safeguarding vital open supply computer software.
Secure the computer software provide chain
ThreatMapper basically scans runtime environments for vulnerabilities across the computer software provide chain, assisting firms to contextualize identified threats and prioritize ones that will need addressed most urgently.
At a time when lots of firms are “shifting left” in terms of focusing their safety checks earlier in the development (pre-deployment) approach, ThreatMapper acknowledges that vulnerabilities nevertheless quite considerably exist in production computer software, scanning proprietary and third-party (e.g. open supply) applications and elements for vulnerabilities.
ThreatMapper is constructed on best of dozens of neighborhood feeds that are applied by other open supply computer software safety scanners out there, which includes the the National Vulnerability Database (NVD). It also funnels into databases from numerous vendors, operating technique distributions, language maintainers, and GitHub repositories.
Deepfence initially launched ThreatMapper as a freemium, proprietary solution last year, and in the intervening months the enterprise has worked with “early adopters” from the developer safety operations (DevSecOps) neighborhood to refine the solution and make it completely open supply.
“ThreatMapper has been a learning experience, as we considered how the technology would evolve, how it could be put to use, and what business model we would put in place to sustain it,” Deepfence’s head of merchandise and neighborhood Owen Garrett told VentureBeat. “Open-sourcing the technology too early would have been a distraction and would have created external pressure, while we iterated on different roadmaps and models.”
While ThreatMapper will shortly be accessible beneath an Apache 2. license, Deepfence is also renaming its industrial enterprise solution as ThreatStryker, which is getting transitioned into a runtime threat mitigation solution making use of insights from ThreatMapper to model the “evolution of sophisticated attacks,” delivering advance warnings of threats and taking actions to block the supply of the attack and quarantine any workload that has been compromised.
In the coming months, Deepfence is also preparing to migrate some of the current premium features more than to the open supply project, such as deep packet inspection (DPI) for network targeted traffic and network and resource anomaly detection. And it is also preparing to create Deepfence into more of a platform by launching APIs to allow developers to integrate ThreatMapper insights into other apps.
“Experimenting in private, without open-sourcing the code too early, has allowed us to come up with a community and enterprise model that we believe will serve the community very well,” Garrett mentioned.
