Bridgecrew announces automated cloud security in VS Code

Bridgecrew announces they’ve shifted their security scanning and fixing technology even further left with a new Visual Studio Code (VS Code) extension. For the first time, developers will be notified about infrastructure as code (IaC) misconfigurations and policy violations at the earliest possible moment within the DevOps lifecycle: while they are coding on their local workstation.

“While Bridgecrew’s mission is to ensure infrastructure security at every stage of the development lifecycle from code and build, through deployment, and into runtime the earlier you catch issues, the less headaches you’ll have later down the road,” said Barak Schoster, CTO, Bridgecrew.

“This is shifting security as early in the lifecycle as possible, directly into the developer’s IDE where they spend most of their time.”

The Systems Sciences Institute at IBM also reports that the cost of a bug increases significantly based on how far down the software development lifecycle it is found.

Identifying, triaging, and fixing software bugs in production is extremely time-consuming, especially in distributed, cloud-native environments.

IBM notes that “the cost to fix an error found after product release was four to five times as much as one uncovered during design, and up to 100 times more than one identified in the maintenance phase.”

The new VS Code extension combines hundreds of out-of-the-box policies from Bridgecrew’s open-source tool Chekov with in-line fixes enabled by Bridgecrew’s APIs.

Launched in December 2019, Checkov has already been downloaded over a million times by developers to scan IaC frameworks for misconfigurations ad hoc or as part of automated CI/CD pipelines.

But the ability to be notified in real-time while coding before that code is committed has been one of the most highly requested features to date. And according to Stack Overflow’s annual Developer Survey, VS Code is the most popular IDE used by developers around the world.

Bridgecrew’s VS Code extension supports all of the major infrastructure as code (IaC) frameworks: Terraform, CloudFormation, Kubernetes manifests, Serverless framework, and Azure Resource Manager (ARM).

Real-time identification and in-line fixes separate this new offering from existing VS Code extensions, which traditionally need to be prompted to scan code (i.e. not real-time scanning) and do not offer fixes for the identified violations.

The VS Code extension will automatically scan for security best practices such as those outlined by the Center of Internet Security (CIS) and against compliance benchmarks such as SOC II, HIPPA, FedRamp, and more.

Palo Alto Networks recently announced their intent to acquire Bridgecrew, stating that “Bridgecrew is a pioneer in shift left” and that “the proposed acquisition will enable Prisma Cloud to provide developers with security assessment and enforcement capabilities throughout the DevOps process.”

Once the deal has closed, Palo Alto Networks will continue to invest in Bridgecrew’s open-source initiatives as part of its ongoing commitment to DevOps security.