Container images are a key component of cloud native applications. However, they typically include many resources outside the control of developers, such as operating systems and configurations. Prisma Cloud allows security teams to implement guardrails to prevent vulnerabilities, compliance violations and exposed secrets in container images.

• Identify vulnerabilities in container images

  Use twistcli to identify vulnerabilities in operating systems and open source packages built into container image layers.

• Provide fix status and remediation guidance

  Give developers the fix status, the minimum version to remediate and the time since the fix was released to prioritize updating packages.

• Alert on or block vulnerabilities by severity level

  Add guardrails to block images with vulnerabilities that don’t meet severity level requirements, before they are pushed to production.

• Achieve container compliance in code

  Check your container image dependencies and configurations for violations against popular benchmarks like CIS and proprietary issues such as malware in build time.

• Ensure trust for container images

  Harden images with build time scanning, surface exposed secrets in containers and leverage trusted registries for a secure container image supply chain.

• Integrate across the software development lifecycle

  Embed security feedback and guardrails in popular CI/CD tools, VCS, and registries.

Cloud-native CI/CD pipelines are increasingly becoming the target of attacks as they give bad actors access to code and secrets, which they use to inject malicious code or pivot to exfiltrate data. Prisma Cloud provides a powerful yet simple way to gain visibility and control of application delivery pipelines. Leverage the platform’s Cloud Application Graph™ to harden CI/CD pipelines over time and prevent security issues from reaching production.

• Full observability of your entire engineering ecosystem

  Gain unified visibility across the engineering ecosystem, including code repositories, contributors, technologies used, pipelines connected along with code risks from IaC Security, SCA, and secrets security.

• Harden CI/CD pipelines

  Informed by world-class CI/CD security research, Prisma Cloud helps teams implement security guardrails to harden their pipelines and achieve optimized CI/CD posture against the OWASP Top 10 CI/CD Risks framework.

• Analyze the entire ecosystem

  Prisma Cloud’s Cloud Application Graph uses relational graph databases so organizations can centralize visibility and control across the engineering ecosystem by correlating disparate signals across codebases, scanners, orchestration and automation tools, and more.

• Generate a software bill of materials (SBOM)

  Generate an SBOM report containing your open source packages, libraries and IaC resources along with associated security issues to track and understand your application risk.

The majority of modern application code is made up of open source dependencies. Lack of awareness of what dependencies are actually in use, and the fear of introducing breaking changes, leads to vulnerabilities going unremediated. Prisma Cloud integrates with developer tools to identify vulnerabilities in open source packages and their full dependency trees with support for flexible and granular bump fixes.

• Leverage industry-leading sources for complete open source security confidence

  Prisma Cloud scans open source dependencies wherever they are and compares them against public databases like NVD and the Prisma Cloud Intelligence Stream to identify vulnerabilities.

• Identify vulnerabilities at any dependency depth and in context

  Prisma Cloud ingests package manager data to extrapolate dependency trees to the furthest layer and connects infrastructure and application risks to prioritize remediations faster.

• Integrate open source security across the development lifecycle

  Surface real-time vulnerability feedback to developers via IDEs and VCS pull/merge requests and block builds based on vulnerability thresholds to proactive keep your cloud-native environment secure.

• Fix issues without introducing breaking changes

  Get the recommended smallest update to fix vulnerabilities in direct and transitive dependencies without the risk of breaking critical functions. Fix multiple issues at once with the flexibility of selecting granular versions per package.