Prevasio CI/CD Container Security

This topic describes how to set up and use AlgoSec’s Prevasio CI/CD Container Security.

AlgoSec Prevasio CI/CD Container Security solution provides an extensible security plug-in for dev team code repositories that perform an automated scan for Docker containers pipelines. AlgoSec Prevasio builds, simulates runtime, and scans the image statically and dynamically for security risks. This is integrated into the user's GitHub repository CI process.

The action is available only to registered Prevasio users. For the official trial, click here.

The Docker container scan runs each time a Pull Request (in GitHub) is created. The summary of the scan appears in the comments of the Pull Request. For example, one critical risk was found in the code in GitHub:

To see a full report of the scan results, click the link to the full scan report.

Note: You can see a list of your open Pull Requests in Prevasio. The Pull Requests lists provides a structured view of the scan details for each open pull request, to help quickly assess and manage your security findings. See Prevasio CI/CD Container Security .

Note: The built-in threat management rules form the basis of the security mechanism used by CI pipeline in GitHub and are described in Threat Management.

Integrations

The Prevasio CI/CD Container Security integrates with the following:

Code repositories GitHub
CI/CD systems GitHub Workflow
Containerization Docker

Set up the Prevasio CI/CD Container Security

For admin and advanced users

Important: Your protected branch rules won't be enforced on your private repository until you move to a GitHub Team or Enterprise organization account.

Do the following:

  1. If you don’t have a GitHub account, create one now.

  2. Log in to Prevasio as user admin. Make sure to write down the tenant ID you are using for later on in this procedure.

  3. Add a new API Access Key. See Add a new API Access Key.

  4. Click on the vertical ellipsis ( ) to the right of the newly created access key.

  5. On the options pop-up menu that is displayed, click View. Save the Client ID and Client Secret for later in this procedure.

  6. Log in to GitHub.

  7. In your GitHub Repository. You can create the workflow in 2 ways:

    1. Use the Action provided on the GitHub marketplace:

      1. Create a new main.yml workflow in the following path:

        <Repo Name>/.github/workflows/main.yml

      2. Copy the Example Usage code provided in the GitHub marketplace and paste to main.yml.

      3. (optional) Edit the yaml file, if required, as follows:

        1. General Parameters:

          Parameter Description Default Type
          WORKING_DIR Specify the GitHub repository's folder that contains the Dockerfile . (root folder) string
          DOCKERFILE_NAME Specify the Dockerfile name Dockerfile string
          MIN_LEVEL_TO_BLOCK_PR Specify the minimum risk severity level to block the PR if at least one risk of this level is found -1 (never block) int

        2. Edit the branch name, if you want to change the name of the target branch.

    2. Generate the action in Prevasio:

      1. Log-in into the Prevasio management console.

      2. In Prevasio, from the left panel select Integrations> CI/CD Container Security.

      3. (Optional) Edit the fields. (Default values are selected if the fields are not changed):

        Description Default
        Specify the GitHub repository's folder that contains the Dockerfile . (root folder)
        Specify the Dockerfile name Dockerfile
        Specify the name of the branch Main
        Specify the minimum risk severity level to block the PR if at least one risk of this level is found -1 (never block)
      4. Click Download GitHub Action.

      5. Copy and paste the downloaded Action to:

        <Repo Name>/.github/workflows/GitHub_Action.yml

  8. In GitHub Settings, select Secrets > Actions. GitHub Action Secrets appears.

  9. In GitHub Action Secrets, add the following Repository Secrets.

    ALGOSEC_TENANT_ID AlgoSec Tenant ID
    ALGOSEC_CLIENT_ID AlgoSec Client ID
    ALGOSEC_CLIENT_SECRET AlgoSec Client Secret

  10. Define the action as a required check:

    1. Go to your repository Actions tab

    2. On the left of the screen, choose the workflow that runs the Prevasio CI/CD Container Security job.

    3. Click Run workflow dropdown. The dropdown expands.

    4. Click the Run workflow button. The workflow runs. Don’t worry if the action fails.

    5. Create a new branch protection rule to define the action as a required check by following these steps:

      1. Go to your GitHub repository Settings tab

      2. Click on Branches on the left sidebar.

      3. Click Add rule / Add branch protection rule.

      4. Specify the target branch the action runs on.

      5. Enable Require status checks to pass before merging.

      6. Add AlgoSec Prevasio CI/CD Container Security as a required check.

      7. Click Create the rule.

Work with the Prevasio CI/CD Container Security action

For code developers

Once the Prevasio CI/CD Container Security action is set up, it’s ready for use.

The following instructions explain how to use Prevasio CI/CD Container Security in your CI/CD workflow.

Do the following:

  1. In your dev environment, upload changes to your developer branch in GitHub.

  2. Click the Pull request tab.

  1. Click New pull request.

  2. Set to compare your working branch to your main (protected) branch. Click Create pull request.

  3. Click View pull request. The Prevasio CI/CD Container Security check runs and the summary of scan results is displayed in the comments section of the Pull Request.

  4. To view the full report, in the comments section, click Full report. The full report opens in a new browser tab.

 

â Next steps: