Stephen Chin, JFrog | KubeCon + CloudNativeCon NA 2022

This is texturing TV. Hey, everyone. Welcome back here.

We're in Detroit on our day three coverage from kubecon called nativecon Sky sitting here next to me really needs no introduction to our audience. I try to get them on his office as I can in between airplanes, right because he's always on an airplane somewhere but say hello to Steve chance. He's with Jay frog and Steve.

Welcome to Detroit. It's Friday. It must be Detroit.

Yeah, it must be to try now. This has been awesome. I think that kubecon like always is kind of this centerpiece conference for the whole developer and Cloud native community.

And this this is the biggest one postcode like it's huge. um it is I don't you know, so it's hard to tell that because It's a it's a really big convention center with a lot of floors and rooms be the all itself as usual the Linux Foundation very Savvy and very conscious and covid has done a good job of spreading things out. Yeah, I don't face out the boots.

They face out the sessions. So I'm very dense all the right. People are here.

It's an amazing. Absolutely. But I I will tell you I thought Valencia was a pretty big show as well.

Yeah, I think a little bigger than balance. This is bigger. What we've seen a little side on conferences in general is like Amy a conferences.

So once we've done in Stockholm, London, Paris like you name it? Like people are just ready to come out they're ready to engage and they've really want to do in person events. Yeah in the US.

It's a little we're a little slower to come back and maybe it's travel maybe yeah, I don't think it's a question of necessarily being afraid of covid. I think people are so used to working at home in their pajamas. So to get them out of their house for a work related.

If you told them we were partying different story. That's that's very true. I really remember that the thing which still is really slow is I run to meet up as well and if people aren't in the office during the day They're not they're not they're not running, you know dinner and running out to go meet up.

So, you know, they got to get dressed. They if you want to do your hair you make up whatever but what it is what it is. Anyway, let's talk a little bit about new side of Jay frog, you know, I saw this when I was out in Israel for y'allah.

and you and I have spoken several times since then is focus on security Now interestingly hearing cubecon. I will tell you that. We probably done 30 something interviews in the last couple days.

More than half have had a very I mean clearly Securities job one. Jay frog fair with some Acquisitions and development come out with some new, you know security-centric products. You and I've spoken about this look Developers.

Are the new attack surface? Right for security attacks. Yeah, and and I think so if developers are the new Target for security attacks.

Then now security which is traditionally been done by security team csos like other organizations. Now security is actually become the number one job of the devops team. Yep.

They run the infrastructure. They run the cicd. They do the deployments like like all the development teams rely on them for centralized shared infrastructure to to release and deploy and if if you're not securing at that bottleneck Then you're letting a lot of vulnerabilities.

You're letting a lot of issues go out into production. So I think that all all of our customers, I mean all the top top companies are using jfrog platform. They're asking us to do more with security and we acquired V2 Yes, which was a really strong security company.

They had a great product. They they do excellent security research and we brought all that security research talent that expertise and just announced a new offering which is our Advanced security. Yes, and I think it solves a bunch of problems which people are talking about But don't actually have a solution for today.

Let's talk about these Sprout. What are the problems? So, you know everybody who everything the security space are like, okay, you know, we can scan source code we can scan your libraries and dependencies we can tell you if you have any zero days, so that's kind of table Stakes.

Yeah, but the biggest issue when you talk to people about their security infrastructure is the number of false positives. It's like 95% of the security issues reported. Don't relate to your application and if that's not new in security, by the way, well, it's it's a it's becoming a more visible problem.

Now that development teams are care about it devops team. You have things like the hr-7900 bill which is a government's requiring companies. Yes to make sure they're not releasing code with known vulnerabilities and that's that's a big problem when you have to filter through all of these inapplicable CVS explain why they're not applicable and justify that to then even sell your software.

It's other people like the government or or know that you're deploying software, which is not full of vulnerabilities. Yep. So that's one of the big things we did with our our new security release was contextual analysis.

Okay, so it doesn't just tell you the severity of the issues when it scans your Docker container. I'll tell you high severity to medium low, but it will also tell you applicable or non-applicable. And it does this by looking at the usage the the other calls to that library in your code base.

And if for example, there's an API. Which you would have to call. for you to be vulnerable to this security exploit if it discovers that none of your other libraries call that API then Not applicable.

You don't have to worry about it and that gets a lot of the work. out of meeting security standards So I've a couple. First of real quick question then comment, will that satisfy the new bills in terms of storage if the Jay frog product labels it not applicable.

You're in you're you've applied. Yeah. Yeah, so you can generate a report and that will be it has all the information about why it's not applicable exactly how it did the scan and like that that's the sort of justification which You don't have to manually do anymore and you shouldn't have to manually do it because if if you're releasing continuously if you're pushing out constant updates to your software and getting new security scans with thousands of issues.

You you're gonna spend all your time justifying why things aren't security issues, which should be an automated test. Absolutely. So now, You know, I had a friend giddy Cohen.

I don't know if you know good, you know, giddy coin giddy started a company 15 years ago Skynet security. And what he used to do is generate what we call The Tack Maps. right, so Very similar this before Coop.

Yeah right now so we scan your infrastructure. We find your vulnerabilities. Then we say is this it's more than just having a vulnerability.

What's the severity? Is it reachable? Is it exploitable?

I when I sit here and here. Cloud native people talk about security scanning like they invented it. Yes, I was doing scanning in 2002.

They're not doing that. So yeah, well. I hear you.

So. so when we for this Advanced security so looking at apis and what's called that you know, it's very it's a very similar or yeah, yeah power up everything. There's all a whole bunch of things which especially when you talk about Cloud native applications, which are very unique so Docker containers typically have a lot of exposed secrets with like API keys and things inside of them you're using Terraform or other infrastructure files to do your deployments and all of those also exposed security risks.

They're not they're not code. They're not they like no. No, they're not necessarily vulnerabilities in terms of bugs or whatever.

They're configuration exactly issues. And that's that's the other thing that is an advancing errors there issue. Nothing there why I mean they're security issues.

Yeah in your configuration. Security issues with your company Secrets being associated Docker images and we also scan and check for those in the event security you do. Yeah.

and then the scanning What is that done? Like is it on demand? Is it automatic is it continuous all of the above?

So I mean one of the good things is if you think about the flow of releases from being you develop it you build it you package it you deploy it. So we're right in the center with the jayfrog platform right artifactory is the database of devops So when you're pushing things into artifactory, it automatically scans them. You can set rules and filters on that.

And also using built info which tells you or release info which tells you where your packages are released. You can also know if there's a new zero day. What are all the affected systems and production that's great that that's another thing I'm hearing from my security friends friends.

There's all this focus on so-called shift left. Yeah security. Is coming at the expense you can't ignore there's a big world out there post for post deployment exactly, right?

Yeah, like when look for Shell happens. Everyone was scrambling to a figure out which systems were when I have it right like you didn't have it unless you Had a system like like the jfrog platform which cataloged everything. You don't know that.

And the the second problem was are you even vulnerable and if you were just using the core log4j apis you were in. So like even though it was like a widespread attack people were patching and updating a lot of systems which weren't actually impacted by the log for Shell exploit right? No doubt.

Now look there's a school of thought says if that's what it took to get them to patch some terrible thing. It's not a total loss as they say but It is what it is. This is part of the Jay frog platform.

I'm gonna put you on the spot. It doesn't cost extra money. Of course it does, okay.

Give me an idea. How's your priced? So basically we have our you know our different tiers.

Enterprise Plus for the large accounts and the J frog Advanced security is an add-on for either of those tiers. If you're an enterprise Enterprise Plus customer Utah. Is it based upon?

How many developers how many skins how many how do you yeah, so on on the security side typically our pricing model we we don't do a user base pricing model. Okay. We think that punishes big devil.

Oh, I mean people out here interested. So yeah, so we do on the Artifact on the platform side. We do it by servers.

Okay, and then for the security solution Advanced security, it's you get a certain number of scans. And yeah, that makes sense. I mean, that's the logical place.

It's gonna measure stuff it's available. Now. Yep available now all the features we talked about and it's things which like if you saw the Google security announcement other things are talking about it, but they don't have it.

Yeah. Now this is look as I said, I see so many parallels to the development of the vulnerability management and then application scanning markets that I've seen over the last 25 years. Hopefully we'll learn from that and this will come faster better.

Yeah, I don't know. I think it it's an important area. And I mean the other thing I'll just briefly mention that we're making big investments in.

Is you know all we've talked about a lot of Enterprise security like how you secure your corporate pipeline, but there's a big issue with open source. And making sure that you're not relying upon vulnerable open source libraries and frankly for the open source projects to have a secure reliable distribution system. And so we just announced a new effort that's going to be an incubating CDF project CD foundation called Persia.

Oh, yeah. Okay. Hence the shirt take a look here.

Actually that camera, okay. and it's it's a it's a secure decentralized way for open source projects to distribute. Their libraries absolutely collaborating with other companies making sure it's Venture neutral as part of the CDF and using Next Generation Technologies, like peer-to-peer networks immutable transaction ledger so that you have something to base your s bombs on and just providing this as a free service to the open source Community.

It's great, you know actually so we had Lori on, you know from CDF from Jay and we actually spoke about it a little bit yesterday and I think we're gonna have some more Persia discussion shortly. So we'll tell you more about first year with our next guest but Steve I want to thank you for coming on so that's good to see you where you headed next. Um, I get I got a weak break.

Oh we most time. I've had not traveling and beautiful months. I'm actually home for a week and then Vegas myself.

So yeah, and then I'm doing the Linux Foundation member Summit. Oh, yeah. And then you'll be reinvent.

Yeah reinvent this one we're doing videos there. We'll make we'll hook up that cool. All right, Steve Chen Jay frog the perseer about Advanced security You know what Stephen where did they go to get information about this?

com. Sorry that I am or purse your dad. com they'll be able to get to the event security stuff.

Okay. Steve Jen from Jay freak here. We're gonna take a break.

We're gonna have some more news or some more discussion on Persia in just a minute or two. Let us reject the set. We're live in Detroit standby.