The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling, and reports any vulnerabilities or malicious packages discovered to repository maintainers and the wider community. Most recently we disclosed 11 malicious packages in the PyPI repository, a discovery that shows attacks are getting more sophisticated in their approach.
In our last blog post How to Pass a FedRAMP Audit for SaaS Providers: Part 1 , we looked at what FedRAMP is and why it matters for SaaS providers. We also discussed a success story with one publicly traded Teleport SaaS customer who used Teleport to pass their FedRAMP audit.
There were several security assessments and compliance frameworks in Kubescape before we released ARMOBest – NSA-CISA and MITRE. Naturally, people ask, why another one? Especially, if it’s not coming from a well-known source that some people may be required to comply with. Some frameworks, like MITRE, are designed bottom-up, mainly focusing on the infrastructure. Others, like NSA-CISA, are designed top-down, paying more attention to the application side.
