Swif.ai employs a comprehensive set of security scanning tools to ensure the safety and integrity of our code, containers, and infrastructure. Below is a summary of the primary tools in use, their purposes, and how they are integrated into our workflows.
1. SonarQube
Purpose:
SonarQube is an open-source platform for continuous inspection of code quality. It performs automatic reviews with static analysis to detect bugs, code smells, and security vulnerabilities across 29 programming languages.
Usage at Swif.ai:
Integrated with our GitLab repositories for ST-API, ST-WEBAPP, and ST-MDM projects.
Automated analysis is triggered on new commits.
Developers are required to address new alerts on their commits.
2. Trivy
Purpose:
Trivy is an open-source vulnerability scanner for container images, file systems, and Git repositories. It is especially effective for scanning Java-based Docker images and Go applications.
Usage at Swif.ai:
Used to scan Docker images for vulnerabilities in both system packages and application dependencies.
Integrated into CI/CD pipelines for automated scanning.
Example scan command for Java-based Docker images:
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd)/trivy-output:/trivy-output docker.io/aquasec/trivy image --severity HIGH,CRITICAL --format json --db-repository aquasec/trivy-db:2 --java-db-repository aquasec/trivy-java-db:1 --timeout 10m xxx.xxx.io/st-apis:6de20dc6
Results are output in JSON format for further processing and review.
3. kube-bench
Purpose:
kube-bench is an open-source tool that checks whether Kubernetes clusters are deployed securely according to the CIS Kubernetes Benchmark.
Usage at Swif.ai:
Used to audit both production and development Kubernetes clusters.
Regular scans are performed, especially after cluster upgrades.
Ensures compliance with security best practices for Kubernetes configuration.
Example findings include checks on file permissions, ownership, and secure configuration of kubelet and kube-proxy.
Security Scanning Practices
Automation: Scanning is automated for code (SonarQube), containers (Trivy), and infrastructure (kube-bench).
Frequency: Scans are performed on every commit (code), during CI/CD builds (containers), and quarterly or after major upgrades (Kubernetes).
Remediation: Developers are expected to address new vulnerabilities as they are detected.
Summary Table
Tool | Target | Purpose |
SonarQube | Source Code | Static code analysis, bug & vulnerability detection |
Trivy | Docker Images | Vulnerability scanning for containers & dependencies |
kube-bench | Kubernetes Clusters | CIS benchmark compliance & cluster hardening |
By leveraging these tools, Swif.ai maintain a robust security posture across our software development lifecycle and infrastructure.
If you have questions about accessing dashboards or running scans, please reach out to the DevOps team.