Kaspersky Hybrid Cloud Security protects software development tools from supply-chain attacks and adds integration with Google Cloud

Kaspersky today announces that the next generation of Kaspersky Hybrid Cloud Security now safeguards software development operations (DevOps) environments. The product has been enhanced to enable protection for containers, add containers, image and repository scanning capabilities for integration with continuous integration and delivery pipelines (CI/CD). Additionally, to support business use of a wide range of public cloud platforms, Kaspersky Hybrid Cloud Security now includes integration with Google Cloud. 

Supply-chain attacks that affect software development, such as when a malicious piece of code is added to legitimate software, are effective tools for cybercriminals. For example, this method was used in the ShadowPad attack where a backdoor was embedded into a popular legitimate business software product’s code library. Supply-chain attacks also strike open source repositories, such as when Docker Hub found 17 backdoored container images, or when RubyGems caused users to download 725 malicious packages almost 100,000 times.

Protection from such supply-chain attacks is essential for software developers, though it can be difficult to find an effective security tool because validating the integrity of fast-changing development environments in a moment’s notice is often technically challenging. A cybersecurity solution should also not affect an application’s time to market or the overall flexible approach to IT that DevOps is accustomed to, such as being able to scale cloud workloads up and down or use different open source tools.

Kaspersky Hybrid Cloud Security reconciles the two worlds of DevOps and IT security. It helps businesses integrate security tools into the development process to minimize the risk of container compromise and supply-chain attacks without impacting development speeds.

The product now enables Docker containerization environments to be protected through granular AV scanning. Using file threat protection, it scans containers and images and all their layers to reveal threats, even those in lower layers. Scanning can be performed as objects are accessed in the namespaces of running containers (on-access scan, OAS) and within tasks with flexible scope control (on-demand scan, ODS). It also allows kernel memory scanning. Added network and web threat protection ensures safe internet traffic and the prevention of network attacks on Linux hosts and containers.

Kaspersky Hybrid Cloud Security safeguards the use of open source code repositories and prevents supply-chain poisoning. Software developers can add security steps into continuous integration and delivery (CI/CD) pipelines including TeamCity or Jenkins Pipeline, among others. Integration is available via command-line and application programming interfaces (CLI and API) that allow developers to run scripts in pipeline management tools for container and repository image scanning at different stages.

Additionally, users of public cloud platforms for software development and other business needs can choose from more options, as the product can now be integrated with Google Cloud as well as existing offerings such as AWS and Microsoft Azure. Kaspersky Hybrid Cloud Security can be seamlessly extended to a customer’s workloads in Google Cloud. Security management for cloud environments is available through a single control panel in Kaspersky Security Center.

“Continuoussoftware development is a unique environment that needs a specific cybersecurity approach. To stay nimble, DevOps may go as far as bypassing formal IT approval processes, making it a challenge to build cybersecurity into the development journey,” said Andrey Pozhogin, senior product marketing manager at Kaspersky. “However, it is important to leverage containers and open source code securely to reduce the risk of unknowingly embedding malicious code into software, as was found in the RubyGems attack and other cases. Kaspersky Hybrid Cloud Security helps businesses find a way out of this challenge through a win-win scenario where IT security and DevOps cooperate. The solution provides understandable tools for DevOps that don’t affect their processes; and it helps IT security teams to put in place a proven protection layer for the part of the infrastructure that may not yet be covered.”

More information about Kaspersky Hybrid Cloud Security and DevOps protection can be found on the product page.