PLEASANTON, Calif.–(BUSINESS WIRE)–Accurics, the cloud cyber resilience specialist, today announced a technology partnership with GitLab, a single application for the DevOps lifecycle, as well as the general availability of its integration with GitLab’s Static Application Security Testing (SAST) solution. Accurics leverages the integration with GitLab to provide DevSecOps teams with a holistic, contextualized view of application and infrastructure risks. Organizations can now establish and programmatically enforce consistent risk management policies throughout the Software Development Lifecycle (SDLC) while minimizing the effort and expense of manual triage and investigation.

Cloud infrastructure and applications are traditionally deployed from two separate pipelines, which dissociates application security vulnerabilities from Infrastructure as Code (IaC) misconfigurations. As a result, developers are often left with a long list of vulnerabilities and misconfigurations to fix without the context required to prioritize remediation of those vulnerabilities and misconfigurations that could actually be exploited.

“The most effective innovation is often incremental – for example, new capabilities and additional functionality accompanied by relevant security advances,” said Om Moolchandani, Co-founder, CTO & CISO at Accurics. “In this environment, we see diverse and largely unconnected vulnerabilities and misconfigurations, collectively producing a level of noise that makes identifying the most serious risks vital but difficult. The partnership with GitLab serves to add greater context to every layer of code and strengthens the security risk posture throughout the extended development lifecycle.”

The integration with GitLab helps Accurics users overcome these challenges by correlating IaC, cloud, and SAST vulnerabilities to help mitigate risk throughout the SDLC and generate a threat score. This threat score can be used by policy guardrails established with Policy as Code, blocking the riskiest builds from being deployed into production while providing insight into less risky problems that don’t warrant breaking the build. As a result, developers are able to focus resources on remediating the most immediate threats first.

“The growing adoption of GitOps practices and Infrastructure as Code necessitates scalable risk management tools,” said Nima Badiey, Vice President, Global Alliances at GitLab. “The integration between GitLab and Accurics will help customers to programmatically define infrastructure and risk management policies more effectively throughout the software development lifecycle.”

At Accurics™, we envision a world where organizations can innovate in the cloud with confidence. Our mission is to enable organizations to achieve cloud cyber resilience with developer-first security that self-heals the cloud. The Accurics platform programmatically detects infrastructure misconfigurations and contextualizes the findings with application risks to identify breach paths throughout the development lifecycle. It automatically generates code to remediate issues and applies the fix in the development pipeline. Accurics enables organizations of all sizes to achieve developer-driven cloud cyber resilience through cloud-based and open source tools such as Terrascan

Accurics today announced it has integrated its tool for discovering violations of security policies that occur when developers provision infrastructure as code with both the continuous integration and continuous delivery (CI/CD) platform and the static application security assessment testing (SAST) tools from GitLab.

Om Moolchandani, chief information and security officer (CISO) and CTO for Accurics, said both integrations make it easier for developers to discover security issues earlier as part of a DevSecOps workflow using the company’s Terrascan tools.

Many of the issues organizations are having with cloud security these days can be traced back to misconfigurations created by developers when configuring infrastructure using tools such as Terraform. Accurics created Terrascan to identify those misconfigurations.

The integration with GitLab makes it easier to incorporate Terrascan into a DevOps workflow in a way that also aggregates data collected from both SAST and dynamic application security testing (DAST) tools, said Moolchandani. That approach effectively unifies what today are two separate cloud infrastructure and application development pipelines by enabling DevOps teams to employ threat scores to enforce security policies as code that are deemed too risky to deploy with block builds, he added.

At the same time, the integration with SAST and DAST tools provides the context developers need to prioritize remediation efforts before applications are deployed in a production environment, noted Moolchandani.

Organizations of all sizes are now trying to strike a balance between two conflicting agendas. On the one hand, infrastructure-as-code (IaC) tools such as Terraform have played a critical role in enabling developers to build and deploy applications faster. The issue is that developers lack the security expertise required to ensure infrastructure is secured properly at a time when cybercriminals are more aggressively seeking to compromise software supply chains. Organizations most likely won’t slow down the rate at which applications are being deployed to make sure software supply chains are not compromised. However, in the absence of best DevSecOps practices—which still are not widely implemented—there may be a backlash against shifting application responsibility left toward developers.

The challenge that creates is most organizations don’t have enough security expertise available to review applications in a timely manner before they are deployed, which results in them hoping security issues will be discovered and remediated during the application update cycle before cybercriminals find a way to exploit a vulnerability.

Of course, hope does not make for an application security strategy. Organizations will need to find ways to enable developers to better secure applications while simultaneously making it easier for cybersecurity teams to maintain a zero-trust IT environment that reduces the chances organizations will be breached via, for example, a phishing attack to steal developer credentials.

Regardless of how DevSecOps workflows and zero-trust IT architectures are implemented, it’s clear organizations have run out of time to resolve longstanding security issues that are now making the kinds of headlines no one wants to see.

Cloud security provider Accurics this week announced a new GitHub application designed to further automate the programmatic enforcement of security policies throughout the software development workflow.

The Accurics platform and the Terrascan tool for detecting compliance and security violations across Infrastructure as Code (IaC) have both been accessible through GitHub Actions for a while. Terrascan is accessible through the popular Super-Linter action. The Accurics platform is available through the company’s own action.

The new GitHub App adds an option for the automation of that enforcement, explained Accurics developer advocate Jon Jarboe, in a blog post. It provides a library of more than 500 policies aligned with compliance standards, such as the CIS benchmark. New commits and pull requests are automatically scanned for policy violations, and when security risks are found, they are added to the PR and/or repo as issues.
By adding Accurics to code scanning, any GitHub user can automate the elimination of security risks from their infrastructure as code before and after deployment, Jarboe said.

“Given the success of high-velocity DevOps teams, we believe that self-healing infrastructure is the only way to embed security into DevOps without breaking it,” Jarboe added. “Reactive processes that require manual actions simply cannot keep up. The rapid adoption of infrastructure as code provides an excellent opportunity to implement guardrails throughout the development lifecycle, starting in the earliest stages.

The new GitHub Accurics App was part of the GitHub announcement this week for integration with new third-party code scanning tools for IaC and container scanning.

“By expanding our GitHub security ecosystem, developers can use their tools of choice for any of their projects on GitHub, all within the native GitHub experience they love,” said GitHub senior business development manager Jose Palafox, in a blog post. “Our integrations tightly couple the developer workflow with a security review through GitHub Actions and Apps.”

Along with Accurics, GitHub announced integrations with 42Crunch (API Contract Security Audit), Bridgecrew (developer-first platform for streamlining cloud security), Snyk Infrastructure as Code and Snyk Container security platforms, Aqua Security (pure-play cloud native security company), and Anchore (enterprise container security workflow solution).

The Pleasanton, CA-based Accurics focuses on enabling “immutable security for immutable infrastructure, so that organizations can embrace cloud native technologies with confidence.” The company’s namesake solution seamlessly scans IaC for misconfigurations based on common policy frameworks and detects potential breach paths to eliminate risks before cloud infrastructure is provisioned. It then monitors provisioned cloud infrastructure for configuration changes that introduce posture drift, and enables reverting to a secure posture.

“GitHub is a luminary in the software development world,” Jarboe said, “and we’re excited to work with them to help deliver to their users the ability to programmatically detect and fix security risks through its new code scanning.”