Security Scanning Tools for Cloud Native Software

This document will describe the changing process model for security scanning and provide a brief survey of security scanning technologies under evaluation.  

Purpose of Security Scanning

Security scanning is a specialized kind of testing that attempts to identify potential software bugs that could make a deployed application vulnerable to attack and compromise.  As with any testing, the tests can be manual or automatic, and they wan be performed at various points in the development cycle.   We can classify security scanning into three categories:

1. Static Scanning - performed against source code / configuration data a static scan looks for common logic errors that might lead to system compromise.  Also referred to as Static Application Security Testing (SAST)
2. Dynamic Scanning - Performed against a running system, a dynamic scan looks for vulnerable software / configurations that might lead to system compromise. Also referred to as Dynamic Application Security Testing (DAST)
3. Security Monitoring - Deployed as a part of the system, a security monitor continuously evaluates the security status relative to a set of rules or policies and reports anomalies.  Best chance to detect and protect against zero-day exploits.

Static and Dynamic scanning are typically integrated into the development process;  security monitoring is delivered as a feature component of the system.

Static Scanning Technology Overview

Name	Target	Type	Detects	Policy Configuration	Notes
Fortify	Source code (including C++, PHP, Java)	Compliance / Vulnerability	Exploitable Coding Defects	User-Defined Policies	Mostly manual execution; CI pipeline automation started in 5G NF 1.3. Cloud Lab provides Pipeline Integration: Fortify Tooling User Guide#gitlabci - Some NFs have started to use this.
McAfee Anti-Malware	Docker Images	Compliance	Malware		Integrated into the 5G CI Pipelines for all 5G NFs (and OC-CNE)
OWASP Dependency Checker	Source Code (Typically Java)	Vulnerability	Known Vulnerabilities (CVEs) in 3rd Party packages (typically Java)		Integrated into the 5G CI Pipelines for all 5G NFs (and OC-CNE)
OCSC 3rd Party	Docker Containers	Compliance / Vulnerably	Oracle Open Source Policy Compliance; 3rd Party SW vulnerabilities (CVEs).		Some overlap with OWASP dependency checker - also verifies 3rd party approval status for all components used in build.
Anchore -Engine	Docker Containers: Base OS, Java, JS, Python packages	Vulnerability	Known Vulnerabilities (CVEs) in Container OS	User-Defined Policies; whitelist/blacklist	Integrated in the OCCNE deployment pipeline in 1.2.

Dynamic Scanning Technology Overview

Name	Target	Type	Detects	Notes
RESTfuzz	RESTful API	Vulnerability	Unexpected responses from unexpected inputs	An Oracle Tool - Integration begin in 5G NF 1.3 pipelines. See RESTfuzz Scanning Guidelines.
OCCNE CipherScan	TLS Ports	Compliance / Vulnerability	OSSA TLS Compliance	An Oracle Tool - plan to start using in 5G NF 1.1 as TLS is introduced
nmap	K8s Environment	Ports Scanner / Penetration Testing	Identifies open ports	Used to identify open ports. This scan is being added as a part of  to identify TLS ports for cipherscanning. (Story target: OCCNE 1.4)
Openscap	Local OS	Compliance / Vulnerability	CIS-inspired Verification; Base OS (and lots more)	Automated execution via CI pipeline in OC-CNE 1.1.
OL 7 CIS Benchmark	Local OS	Compliance	CIS Verification; Base OS	Automated execution vi CI pipeline planned.
docker-bench-security	Docker Environment	Compliance	Insecure Docker configuration	Automated execution via CI pipeline in OC-CNE 1.1.
kube-bench	K8s Environment	Compliance	Insecure K8s configuration	Automated execution via CI pipeline in OC-CNE 1.1.
kube-hunter	K8s Environment	Pen Test	Automated Penetration Testing	To be evaluated
kube-scan	Workload Security Assessment	Compliance	Scores workload for questionable configurations	To be evaluated
webinspect	OAM GUIs	Vulnerability	Unexpected responses from unexpected inputs	We need to run this against out CNCC offering

Monitoring Technology Overview

Name	Target	Detects	Notes
Pod Security Policies	K8s Environment	Non-conformant pods	Pod security Policies look for pods that don't match a configured security policy and refuses to run them.
Falco	K8S Environment	Security Anomalies	Need to try this and understand run-time impact if any; also need to understand what checks some built in.
Sysdig	K8S Environment	System Call Tracing	Need to try this and understand run-time impact if any; also need to understand what checks some built in.
NeuVector	K8S Environment	Security Anomalies
StackRox	K8s Environment	Security Anomalies	Adds machine learning to standard set of run-time checks.
Starboard	K8s Environment	Kubectl integration of security tooling	Adds ability to integrate 3rd party security tools (compliance, vulnerabilities, etc) into the kubectl API.