Familiarize Yourself with Application Security

Learn more about Application Security through multiple functionalities that help you secure your software development lifecycle.

Comprehensive Visibility

Real time, ongoing, comprehensive and accurate analysis of your technical stack, visualized through the following features:

• Repositories: A broad overview view of your organization’s assets, providing detailed analysis of more than 600 programming languages and frameworks, technologies and integrations in its environment. You can see information about all your connected repositories, VCS in use, technologies, CI/CD pipelines, and more. In addition, a summary of IaC misconfigurations, secrets exposed, SCA violations and CI/CD Risks is displayed, giving you a comprehensive and accurate view of your organization’s repositories.
• Technologies: An inventory of 100+ SDLC technologies in use across your software development delivery lifecycle. In addition you can view Supply Chain 3rd party inventories of all the apps and webhooks, Jenkins plugins and pipeline tools detected in your environment.
• SBOM: A detailed inventory of third-party components in the code, highlighting open-source packages and enabling tracking of both direct and indirect dependencies. It places a particular emphasis on identifying and addressing vulnerable software packages.
• Application Security Dashboard: The Application/Code Security dashboard provides a unified view of the most critical application security vulnerabilities and misconfigurations detected during scans. This view provides a contextual understanding of high priority errors categorized by severity, common policy errors, licensing errors, IaC misconfigurations, CVE vulnerabilities and more.

Investigate Application Security

View your software development life cycle (SLDC) as a graphical representation. This visibility allows you to perform an in-depth analysis of security issues across your entire engineering ecosystem. You can digest and understand the assets in your environment, and the relationships between them.

For more see Application Asset Queries.

Risk Prevention

Address root causes, preemptively mitigate risks in code, and stop real-time cloud breaches using precise, contextual and expert remediation through the following features.

• Projects: A consolidated view of application security scan results performed by Prisma Cloud, categorized into the following code categories: IaC misconfigurations, Vulnerabilities, Secrets, and Licenses, across periodic scans of default , CI/CD runs and pull requests. A contextual summary of all issues across code categories is displayed under the Overview.
• CI/CD Risks: Displays all vulnerabilities detected in your CI/CD pipelines, including details such as the risk severity, the location and suggested remediation.

Developer Integrations

• Detection: You can run automated scans through various interfaces, including a dedicated command line interface (CLI), integrated development environment (IDE), and version control system (VCS) to identify cloud infrastructure misconfigurations and vulnerabilities across IaC, SCA, Secrets and Licenses. Remediation.
• Remediation: The Application Security module automatically generates code fixes and patches to address vulnerabilities and secure your code. It offers integrated pull request comments, fixes, and smart fixes that automate the security code review process and streamline remediation efforts.

Refer to IDE for more on the Prisma Cloud plugin for your IDE.

Fundamental Concepts

Familiarize yourself with the following fundamental concepts.

Concept	Definition
AppSec	The practices and tools used to protect applications from external threats and ensure their confidentiality, integrity, and availability. This includes identifying and addressing security vulnerabilities in the application code, as well as ensuring that security controls are implemented throughout the application development lifecycle.
SIP	Security In the Pipeline (SIP) addresses the risk of code with security flaws flowing through the pipeline, providing the most effective measures tailored to the organization stack in order to detect such issues.
SAP	Security Around the Pipeline (SAP) addresses the risk of the pipeline being bypassed.
SOP	Security Of the Pipeline (SOP) addresses the security posture and the risk of security settings in pipeline systems such as the source control, CI, artifact repositories and container registries being compromised. SOP prevents the abuse of software delivery systems and processes in order to access the production environment.
Repositories	A comprehensive view of an organization’s engineering technical stack from repository to deployment. See Repositories for more information.
Application Graph/ Graph View	The repository’s path to production and connectivity between artifacts, presented in graph view. See Repository Application Graphs for more information.
Technologies	An inventory of technologies in use across your organization’s engineering environment. Includes applications and webhooks, Jenkins plugins and pipeline tools. See Technologies for more information.
CI/CD pipeline	A set of practices and tools used to automate the building, testing, and deployment of software applications, facilitating the software development process.
CI/CD risks	Risks in the CI/CD pipeline detected in the organization’s VCS, CI and artifacts, as well as cross-system risks. See CI/CD Risks for more information.
CI/CD risk categories	Categories of CI/CD risks resulting from research into attack vectors associated with CI/CD, and the analysis of high profile breaches and security flaws as published by OWASP, allowing organizations to identify focus areas for securing their CI/CD ecosystems.
Suppress CI/CD risks	Intentionally silence a specific warning of a risk detected in the CI/CD pipeline. This is often done when the issue is deemed low-risk or otherwise unimportant, and the developer wishes to prevent the warning or error message from appearing in future code scans or builds. See here for more on suppressing CI/CD risks.
VCS 3rd Parties	Applications and webhooks connected to the VCS. See VCS 3rd Parties for more information.
Jenkins Servers	An inventory of Jenkins server instances in the system. See Jenkins Servers for more information.
Pipeline Tools	An inventory of third party services and tools found in CI files. See Pipeline Tools for more information.
Policies	A set of rules defining the expected behavior and configurations of resources such as cloud services. Policies cover a wide range of areas such as access control, encryption and compliance.
Resource	A resource is a Cloud Platform entity, for example, an Amazon EC2 instance, a CloudFormation stack, or an Amazon S3 bucket.
Incident	During each scan, incidents corresponding to each instance of non-conformance to a policy in IaC, SCA, and Secrets files in buildtime environments are created.
Errors	During each scan, errors corresponding to each instance of non-conformance to a policy in runtime environments are created.
Suppression	Suppression indicates that an incident is not problematic. You can Suppress an incident for all relevant resources or for a specific resource only.
Remediation	The following types of remediation are available, depending on the type of incident : Open Jira Ticket, Run Playbook, Open Fix PR.