devopsy.kinsta.cloud

Tag: Fugue

  • Snyk Acquires Fugue to Secure Cloud Infrastructure

    Snyk Acquires Fugue to Secure Cloud Infrastructure

    Snyk today announced it has acquired Fugue as part of an effort to embed security within an infrastructure-as-code (IaC) provisioning tool.

    The Fugue platform combines a unified policy engine with an implementation of the open source Open Policy Agent (OPA) software, dubbed Regula, to ensure security and compliance policies are consistently enforced. OPA provides IT teams with a tool for declaratively applying policies and is being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

    The Fugue IaC tool also provides pre-deployment security checks for Terraform, AWS CloudFormation, Kubernetes manifests and Dockerfiles. It enables IT teams to create and test custom policies using Rego, the programming language created for OPA. In addition, there are interactive visual maps of IaC templates and the ability to export IaC diagrams that IT teams can use for planning and approval processes.

    Josh Stella, the former CEO of Fugue who is now a chief architect for Snyk, said Regula is designed to make it possible to apply those policies to both cloud-native and legacy monolithic applications. Tighter integration with the cloud security posture management (CSPM) tools that Snyk provides will make it possible to provide developers with an instant feedback loop as they provision infrastructure, he added. Armed with that intelligence, it becomes less likely that mistakes will be made and that cybercriminals can take advantage of those, noted Stella.

    DevOps teams should also expect to see Fugue integrated with the artificial intelligence capabilities Snyk gained with the acquisition of DeepCode, a provider of an interpretable machine learning semantic code analysis tool that scans code anywhere from 10 to 50 times faster than existing approaches. In total, Snyk has acquired five companies in the last 18 months, including CloudSkiff, FossID, Manifold and DeepCode.

    Misconfigurations of IT infrastructure have emerged as a major issue in the cloud era. Developers often have little to no cybersecurity expertise, and using application programming interfaces (APIs) to provision IT infrastructure themselves increases the chance that mistakes will be made. The acquisition of Fugue creates an opportunity to address that issue at a time when the management of infrastructure and applications is converging, said Stella.

    The amount of focus on cloud security also is increasing as part of a larger discussion involving software supply chains that increasingly becoming targets of attack. Cybercriminals are becoming more adept at scanning for vulnerabilities created when developers, for example, inadvertently leave open a port on a cloud service through which data can be exfiltrated.

    It’s not clear just how far responsibility for cybersecurity will shift left toward developers in the months and years ahead. However, as more intelligence is incorporated into the tools that developers use, the easier it will become to automate DevSecOps best practices. In fact, the goal should be to make it easier to build more secure applications faster rather than forcing organizations to slow down to deal with security issues that should never happened in the first place.

  • Fugue Marries Compliance-as-Code Tool to AWS Well-Architected Framework

    Fugue Marries Compliance-as-Code Tool to AWS Well-Architected Framework

    Fugue has infused the best practices defined by Amazon Web Services (AWS) within its software-as-a-service (SaaS) offering for provisioning infrastructure using its infrastructure-as-code (IaC) platform.

    Fugue CEO Josh Stella said that IT teams can now evaluate templates for provisioning AWS infrastructure that were created using AWS CloudFormation or Terraform tools to ensure they comply with the AWS Well-Architected Framework.

    The AWS Well-Architected Framework spans five pillars that AWS has defined for designing and operating reliable, secure, efficient and cost-effective systems in the cloud. AWS has defined a set of best practices for each pillar and rewards organizations for following those by making available additional cloud credits. The goal is to improve overall cloud security by providing guidance that ultimately reduces the number of misconfigurations so that cybercriminals can’t discover and exploit them.

    The Fugue platform complements that effort because it is based on Open Policy Agent (OPA), a general-purpose engine for managing compliance-as-code that is being advanced under the auspices of the Cloud Native Computing Foundation (CNCF). Fugue extended OPA by creating Regula, an open source tool that evaluates IaC files for potential security and compliance violations. Fugue then created a SaaS platform that makes extensive use of the AWS Lambda serverless computing platform to make it easier to enforce compliance policies.

    Those policies include turnkey coverage for specifications such as SOC 2, NIST 800-53, GDPR, PCI, HIPAA, ISO 27001, CSA CCM, CIS Controls, CIS Docker and CIS Foundations Benchmarks for AWS, Microsoft Azure, Google Cloud and Kubernetes.

    Stella said Fugue has now incorporated the technical aspects of the AWS Well-Architected Framework. However, it’s still up to each IT team to navigate the cultural aspects of the shared responsibility model of compliance and security that cloud service providers like AWS follow.

    Unfortunately, developers that employ IaC tools to provision cloud infrastructure often make some faulty assumptions about the level of security maintained by the cloud service provider. The result is often a raft of security and compliance issues that arise mainly because most developers don’t have a lot of domain knowledge expertise in either area.

    It’s not clear how many organizations have adopted the AWS Well-Architected Framework, but as various tools make it easier to implement these best practices defined by AWS the more secure and efficient cloud computing environments should become. In fact, in many cases, those tools are being embedded within a larger set of DevSecOps best practices that are being implemented across multiple clouds.

    Stella said he doubted there will ever be any standardization when it comes to security and compliance frameworks that could be applied to multiple clouds; however, it’s clear that cloud service providers are at least making available frameworks that borrow concepts from one another.

    Regardless of the approach, the overall state of cloud security and compliance will continue to improve as more guardrails are automatically implemented. The issue then becomes not only finding a way to ensure that cloud infrastructure is secure when deployed and also determining how much of the infrastructure being relied on today is less secure than it should be.

  • Fugue Aims to Simplify Securing Infrastructure-as-Code

    Fugue Aims to Simplify Securing Infrastructure-as-Code

    Fugue today unveiled a 1.0 release for Regula, an open source policy engine for infrastructure-as-code (IaC) security that comes with prebuilt libraries for implementing hundreds of policies that validate configurations on Amazon Web Services (AWS), Microsoft Azure and Google Cloud services.

    Regula is based on the Open Policy Agent (OPA) software being advanced under the auspices of the Cloud Native Computing Foundation (CNCF) and is compatible with both Terraform and AWS CloudFormation tools for configuring cloud infrastructure.

    Developers can also build custom rules on top of OPA using libraries that Fugue created for the Rego programing language that is part of the OPA specification. Regula supports output formats such as JUnit, Test Anything Protocol (TAP) and JSON to make it easier to integrate Regula with other tools and frameworks that make up a DevOps workflow. Input formats supported include Terraform HCL, Terraform plan JSON, AWS CloudFormation and Serverless Application Model templates.

    Regula also provides out-of-the-box support for the CIS Foundations Benchmarks in addition to other policies defined by Fugue, such as dangerously permissive identity access management (IAM) policies, Lambda function policies allowing global access, volumes with encryption disabled and untagged cloud resources.

    It is deployed as a pre-packaged binary that includes a command line interface (CLI) through which Regula can be incorporated within a DevOps workflow and can be installed using tools such as Homebrew or deployed as a Docker image.

    Fugue CEO Josh Stella said Regula provides DevOps teams with an extensive library of rules that check for common security and compliance violations as well as advanced multi-resource misconfigurations. That latter issue is especially challenging because developers typically don’t have much visibility into dependencies that can inadvertently provide cybercriminals with access to, for example, an S3 cloud storage bucket that otherwise appears to be configured properly. Regula will also identify any required resources that might be missing, as well, added Stella.

    Stella said Regula 1.0 provides a simpler approach to securing cloud infrastructure. Cloud infrastructure is frequently misconfigured simply because a developer made a mistake. Unfortunately, cybercriminals have become especially adept at scanning cloud platforms for these misconfigurations, noted Stella.

    It’s not clear to what degree a backlash might be building against IaC in the wake of recent high-profile breaches of software supply chains. Organizations have embraced IaC tools to make developers more productive. However, each security incident involving a misconfiguration of cloud infrastructure resources makes it all too apparent that developers lack the expertise required to securely provision IT environments. Rather than creating a series of cybersecurity reviews that would reduce developer productivity, Stella said Fugue is making a case for a compliance-as-code approach that developers can readily understand and implement.

    One way or another, cloud infrastructure has to become more secure. Business leaders are growing weary of security incidents that, from their perspective, are caused by careless mistakes. Their first instinct is to empower cybersecurity teams to resolve those issues once and for all. The only issue that needs to be resolved now is just how cumbersome those security reviews need to be if developers are provided with the tooling required to secure cloud platforms themselves.

  • Fugue Announces IaC Security for AWS CloudFormation in Regula, the Open-Source Policy Engine

    Regula performs security checks on AWS CloudFormation and Terraform infrastructure as code for AWS, Microsoft Azure, and Google Cloud environments

    Frederick, MD –  May 11, 2021 – Fugue, the company helping organizations innovate faster and more securely in the cloud, announced support for AWS CloudFormation in Regula, the open-source infrastructure as code (IaC) policy engine. Cloud engineering and security teams can now use Regula to secure their AWS CloudFormation and Terraform configurations prior to deployment—and apply those same rules to running cloud environments using the Fugue platform to secure the entire cloud development lifecycle. Expanding Regula capabilities represents Fugue’s continued leadership in innovating on policy as code for IaC and running cloud infrastructure since 2015.

    Regula is ideal for organizations with DevOps teams that use both AWS CloudFormation and Terraform—and those operating multi-cloud environments. Regula is the only AWS CloudFormation security tool that can address vulnerabilities involving multiple resources, and the only one that helps teams meet the CIS AWS Foundations Benchmarks 1.2.0 and 1.3.0. Regula easily integrates into CI/CD pipelines and enables pre-commit IaC checks and provides pull request feedback. Fugue provides examples of Regula working with GitHub Actions for CI/CD.

    “At Cadwell, we needed an effective way to check our infrastructure as code to ensure our cloud infrastructure deployments are secure so we can move faster in the cloud with confidence,” said Sawyer Ward, Enterprise Support Specialist at Cadwell Industries, Inc. “Regula is ideal for our infrastructure as code security requirements, and the ability to apply those same rules to our cloud environment with Fugue means we can keep our infrastructure in continuous compliance and avoid the risks and overhead of maintaining multiple policy frameworks.”

    While Regula works independently of Fugue, teams can use Fugue to apply the same Regula rules to assess the security posture of their running AWS, Azure, and Google Cloud cloud infrastructure environments, eliminating the investment and cloud risk associated with using and reconciling different policy frameworks for different stages of the cloud development lifecycle and for different cloud platforms.

    “Companies operating at scale in the cloud need a policy as code framework that’s flexible, works with the leading infrastructure as code tools, and can be used across cloud platforms at every stage of the cloud development lifecycle,” said Josh Stella, co-founder and CEO of Fugue. “By extending Regula support to AWS CloudFormation, cloud engineering and security teams now have a unified cloud policy framework that works with their tools and workflows, giving them the confidence to move faster in the cloud—without breaking the rules needed to keep cloud infrastructure secure and in compliance.”

    Regula’s rule library checks for a wide variety of cloud misconfiguration vulnerabilities, such as dangerously permissive AWS IAM policies and security group rules, S3 buckets without “block public access” options enabled, Lambda function policies allowing global access, VPCs with flow logs disabled, EBS volumes with encryption disabled, and untagged cloud resources. View the full set of Regula rules here.

    Regula supports user-defined rules using the Rego query language developed by the Open Policy Agent project—and includes helper libraries that enable users to easily build their own rules that conform to enterprise policies. Fugue created and open-sourced Fregot, a tool that enables developers to easily evaluate Rego expressions, debug code, and test policies.

    Regula is available today on Fugue’s public GitHub repository and on DockerHub.

    About Fugue

    Fugue helps organizations move faster in the cloud—without breaking the rules needed to keep cloud environments secure. The Fugue platform secures the entire cloud development lifecycle—from infrastructure as code through the cloud runtime. Fugue empowers cloud engineering and security teams to prove continuous compliance, build security into cloud development, and eliminate cloud misconfiguration. Fugue supports Amazon Web Services, Microsoft Azure, and Google Cloud, and provides one-click reporting for CIS Foundations Benchmarks, CIS Controls, CIS Docker, CSA CCM, GDPR, HIPAA, ISO 27001, NIST 800-53, PCI, and SOC 2. Customers such as AT&T, SAP NS2, and Red Ventures trust Fugue to protect their cloud environments. To learn more, visit www.fugue.co.

  • Fugue Announces Free Tier to Empower Engineers to Build and Operate Secure Cloud Systems

    Fugue Developer provides automation tools to visualize cloud infrastructure, identify misconfiguration risks, and demonstrate compliance

    Frederick, Md. – November 21, 2019 – Fugue, the company delivering autonomous cloud infrastructure security and compliance to the enterprise, today announced Fugue Developer, a free tier that puts engineers in command of cloud security through the entire software development lifecycle (SDLC). Fugue Developer provides automation tools to visualize cloud infrastructure, detect misconfiguration risks and policy violations, understand infrastructure change, and demonstrate compliance.

    Cloud misconfiguration is the number one cause of cloud-based data breaches, and traditional cloud security has failed to address it while frustrating developers with overbearing constraints and time-consuming manual processes. Fugue recognizes that engineers own the security of their cloud infrastructure, and Fugue Developer empowers them with the tools they need to build and operate securely in highly dynamic and regulated cloud environments.

    “A lot of attack vectors are exploited via cloud misconfiguration, said Carl Alleyne, senior DevOps engineer at New Light Technologies. “Fugue gives DevOps engineers and administrators a leg up on cloud asset management and configuration drift detection.”

    Fugue Developer enables engineers to:

    • Auto-generate visualization diagrams of cloud infrastructure and inspect resource configurations and relationships
    • Identify cloud misconfiguration risks and policy violations at every stage of the SDLC and get rich feedback to quickly correct them
    • Demonstrate cloud infrastructure compliance for CIS Foundations Benchmarks, Fugue Best Practices, and custom policies
    • Monitor changes to cloud infrastructure to understand the impact on the security and compliance posture of their environment
    • Protect security-critical cloud resources with drift detection and automated remediation without the burdens of scripts and bots

    “The cloud upended traditional IT security, forcing hard tradeoffs between agility and security that results in neither while impeding those in a position to make a difference—software developers,” said Phillip Merrick, CEO of Fugue. “Fugue Developer puts cloud security in the hands of the developers building and maintaining cloud-based systems so they can free themselves of these frustrations once and for all.”

    Fugue Developer provides an API and CLI to automate infrastructure policy validations and integrate cloud security in CI/CD pipelines, and a rich GUI for dynamic, exportable visualizations that can handle at-scale cloud environments. Fugue Developer supports custom rules using the open source Rego policy language and Open Policy Agent (OPA) engine. Out-of-the-box support is provided for CIS Foundations Bechmarks for Amazon Web Services (AWS) and Microsoft Azure, and the Fugue Best Practices Framework for identifying advanced cloud misconfiguration vulnerabilities.

    Fugue Developer is available now for individual engineers here. Customers receive a 30-day free trial of Fugue Enterprise, after which they can choose to purchase Fugue Enterprise or transition to Fugue Developer. Fugue Enterprise supports unlimited users and environments, and additional out-of-the-box support for NIST 800-53, PCI, HIPAA, SOC 2, GDPR, and ISO 27001. Fugue is a Software as a Service (SaaS) product.

    About Fugue

    Fugue is enterprise cloud security developed for engineers, by engineers. Fugue prevents cloud misconfiguration, ensures continuous compliance with enterprise security policies, and provides full visibility into the security posture of AWS and Azure cloud environments. Fugue automates compliance validation for CIS Foundations Benchmarks, GDPR, HIPAA, ISO 27001, NIST 800-53, PCI, and SOC 2. Customers such as PBS, Sparkpost, SAP NS2, and TrueCar trust Fugue to protect their cloud environments. Fugue’s investors include New Enterprise Associates, Future Fund, and In-Q-Tel (IQT). Fugue is an AWS Advanced Technology Partner and a Launch Partner in the AWS Cloud Management Tools Competency Program in the Governance category. Fugue has twice been named a CyberSecurity Breakthrough Award winner and a Gartner Cool Vendor in Cloud Computing. To learn more, visit www.fugue.co.

  • Fugue Open Sources Fregot to Support Developers Working with the Rego Policy Language

    Frederick, Md. – November 14, 2019 – Fugue, the company empowering engineers to build and operate secure cloud systems that are compliant with enterprise policies, today announced it has open sourced the Fugue Rego Toolkit (Fregot) to enhance the experience working with the Rego policy language. Fregot enables developers to easily evaluate Rego expressions, debug code, and test policies. Rego is part of the Open Policy Agent (OPA) policy engine, which Fugue adopted this year as its policy as code implementation for cloud security and compliance.

    Developed as an alternative to Open Policy Agent’s (OPA) built-in interpreter, Fregot provides error handling that is easy to understand and manage with step-by-step debugging. Additionally, Fregot speeds up the development feedback loop by watching Rego and input files for changes and enabling quick incremental loads. You can use Fregot to validate nearly any kind of JSON or YAML file against Rego policy.

    Fugue created Fregot internally as a lightweight set of tools to enhance the Rego development experience. It provides:

    • Just the Rego language implementation rather than the full OPA agent
    • Useful tools to debug Rego queries and modules
    • Enhanced error messages to aid in correcting Rego expressions
    • Ease of extending and experimenting with new language features

    “Fugue’s SaaS product for cloud infrastructure visibility and security uses Rego and OPA at scale, performing more than 100 million policy evaluations every day and providing our customers with a simple way to create custom policies for cloud infrastructure,” said Josh Stella, co-founder and CTO of Fugue. “We developed Fregot to speed the implementation of these evaluations and provide our customers and the community with useful tools to develop and test policies using the Rego policy language.”

    The Fregot open source project can be found here on Github.

    About Fugue

    Fugue is enterprise cloud security developed for engineers, by engineers. Fugue prevents cloud misconfiguration, ensures continuous compliance with enterprise security policies, and provides full visibility into the security posture of AWS and Azure cloud environments. Fugue automates compliance validation for CIS Foundations Benchmarks, GDPR, HIPAA, ISO 27001, NIST 800-53, PCI, and SOC 2. Customers such as PBS, Sparkpost, SAP NS2, and TrueCar trust Fugue to protect their cloud environments. Fugue’s investors include New Enterprise Associates, Future Fund, and In-Q-Tel (IQT). Fugue is an AWS Advanced Technology Partner and a Launch Partner in the AWS Cloud Management Tools Competency Program in the Governance category. Fugue has twice been named a CyberSecurity Breakthrough Award winner and a Gartner Cool Vendor in Cloud Computing. To learn more, visit www.fugue.co.

     

  • Cloud Security: Self-Healing Infrastructure With Fugue

    Cloud Security: Self-Healing Infrastructure With Fugue

    Misconfiguration is the No. 1 cause for data breach in the cloud. Fugue helps to eliminate data breaches, as it fixes anything that gets drifted by providing baseline drift detection and automated remediation. Fugue is all about cloud security. It identifies security risks and compliance violations and ensures they’re never repeated.

    During this interview, Josh Stella, co-founder and CTO of Fugue, explained how his company offers developer-friendly tools that tell you if you are “breaking a rule and how to fix it,” providing visibility and control for all DevSecOps teams. With the self-healing cloud infrastructure, Fugue corrects misconfiguration and works on a whole configuration without having to write code or automation scripts.

    Check out the interview below, which also includes a demo of how the technology works by Stella himself.

    — Alan Shimel