Code and binary security analysis

3 minute read

The CloudBees platform performs an implicit security analysis, automatically triggering scans on code assets when you create a component, or when you commit changes to a linked repository. It also automatically triggers scans on binary assets whenever a workflow runs successfully with the upload artifact build step.

Findings from security scans are displayed in the Security center and in the components security summary.

Implicit code security assessment

To enable implicit code security analysis:

  1. Select an organization. Optionally, select a component.

  2. Select Security  Marketplace.

  3. Toggle Implicit security assessment to active.

  4. Activate one or more code security tools, such as Checkov or Gosec. The following code security tools are currently available in the CloudBees platform:

    Code security scanners
    Security tool Description Supported languages Explicit or implicit Scan type Installation type

    Black Duck SCA

    Scans open-source dependencies for known vulnerabilities and license risks.

    Explicit

    Code

    Both single and multi tenant

    Checkov

    Scans cloud infrastructure configurations, including Terraform and Cloud Formation scripts.

    Implicit

    Code

    Both single and multi tenant

    Coverity on Polaris

    Enterprise-grade static analysis for code security and quality.

    Explicit

    Code

    Both single and multi tenant

    Gitleaks

    Scans Git repositories for sensitive content, such as credentials.

    N/A (language agnostic)

    Implicit

    Code

    Both single and multi tenant

    Gosec

    An open source Golang security scanner.

    Implicit

    Code

    Both single and multi tenant

    Njsscan

    An open source Node.js security scanner.

    Implicit

    Code

    Both single and multi tenant

    SCC Scanner

    An application software language analyzer. SCC Scanner is enabled on the CloudBees platform by default.

    Implicit

    Code

    Single-tenant

    SonarQube

    Detects bugs, code smells, and security vulnerabilities across multiple languages.

    Explicit

    Code

    Both single and multi tenant

Once enabled, an implicit security scan is triggered automatically when you perform the following actions:

  • Create a component.

  • Commit a change, or create a branch, in any repository linked to a component.

    Implicit code security assessment currently supports two source code management integrations: GitHub and Bitbucket Data Center.

Binary security analysis

The CloudBees platform also performs binary security analysis. Currently, it uses CloudBees platform workflows, and triggers a binary scanner such as Trivy or FindSecBugs whenever a configured workflow is invoked. The following binary security tools are currently available on the CloudBees platform:

Binary security scanners
Security tool Description Supported languages Explicit or implicit Scan type Installation type

FindSecBugs

An open source Java security scanner. Used in CloudBees to scan binary .jar files.

Implicit

Binary

Both single and multi tenant

Grype

A vulnerability scanner for container images, SBOMs, and file systems.

Implicit

Binary

Both single and multi tenant

Syft SBOM

Generates software bills of materials (SBOMs) from containers and binaries.

Implicit

Binary

Both single and multi tenant

Trivy

A Docker image scanner that supports OS packages and language-specific dependencies.

Implicit

Binary

Both single and multi tenant

This capability will eventually be expanded to become implicit, using AWS and JFrog master and decorator plugins to connect to an account, scan repositories of interest, detect when new images are pushed to the repository, and trigger an implicit security scan when an image is pushed.

To trigger a binary security analysis of a file produced by a workflow, add the following to the workflow:

At this time, you can only perform a single binary scan per workflow. Triggering additional scans will override the results of the previous scan.
- id: upload-binary name: Upload binary using action uses: https://github.com/cloudbees-io/asset-chain-utils/upload-binary@v1 with: file-path: directory/subdirectory/container-image.tar(1) file-type: BINARY_CONTAINER(2)
1 Replace the contents of file-path with the path to your binary file. The path is relative to the CloudBees workspace. file-path must always point to a file.
2 Two file types are supported:
  • BINARY_CONTAINER: A container image file.

  • BINARY_JAR: Use this if you have a workflow that checks out Java code to build a .jar executable.

Once added to your workflow, every time you upload a binary file to the specified path, upload-binary triggers a secondary workflow which scans the file. It will also, if enabled, create a Software bill of materials (SBOM).

Scan findings sit alongside the code security analysis results in the Security center, attributed to a component branch.

Binary findings in the security center only relate to the last produced binary. Unlike the code asset profile for a component or branch, which is retained over time and updated with the latest results, each produced binary becomes a separate asset profile with its own set of findings, so only the latest is important.