ActiveState Allies with Docker to Harden Software Artifacts

ActiveState and Docker have entered a partnership to simplify the process for software development teams to access hardened container images and libraries. These resources have been certified using the Supply-chain Levels for Software Artifacts (SLSA) framework, specifically Level 3. ActiveState CEO Abby Kearns explained that this alliance establishes an ecosystem centered around a collection of hardened open-source software artifacts, aiming to enhance the security of software supply chains.

Docker currently manages over 4,000 hardened images, while ActiveState offers access to numerous libraries in 10 programming languages. Additionally, ActiveState ensures a Service Level Agreement (SLA), guaranteeing the availability of hardened libraries within five days of a vulnerability fix in an open-source project. The timing of organizations' adoption of secure software supply chains remains unclear, but with AI enabling cybercriminals to quickly reverse engineer vulnerabilities, the risk is growing.

A recent ActiveState survey revealed that 91% of application development teams have limited visibility into container components, and 90% still utilize lightly modified public images with minimal hardening. Despite this, 98% of survey respondents consider adopting hardened images a high priority. Nonetheless, the escalating use of AI coding tools is resulting in more open-source software dependencies, increasing the prevalence of potentially vulnerable code.

Mitch Ashley, vice president of software lifecycle engineering at Futurum Group, emphasized that hardening images and libraries requires ongoing engineering efforts, including dependency tracking, rebuilding upon upstream fixes, and proving provenance. While ActiveState and Docker aim to manage this rebuilding and patching process, they face the challenge of maintaining their velocity ahead of the exploit window.

The primary concern now is reducing the number of incidents rather than whether a vulnerability will be exploited. By deploying hardened artifacts, organizations can lessen the incident count. Docker offers SLSA Build Level 3 provenance, while ActiveState constructs components within SLSA Level 3 infrastructure, aiding in the verification of software artifacts' building processes and safeguarding against build tampering.