# data[].attributes.attachment_link.readable_text
March 4th 2021, San Diego, CA - Prancer Enterprise is announcing that its entire cloud compliance policies repository is now open source. The repository is available on GitHub at
https://github.com/prancer-io/prancer-compliance-test
This move reflects Prancer's commitment to open source technology and harness the power of community collaboration to move great ideas through the pipeline faster.
These compliance policies that focused on IaC Security and live cloud resources are based on CIS, NIST 800, PCI, HIPPA, HITRUST, CSA CCM and ISO 27001 compliance standards. These policies are all in REGO Open Policy Agent (OPA) language.

Prancer Enterprise platform helps companies achieve end-to-end security in the cloud by shifting security to the left and apply it early in the development process. Cloud DevOps engineers could have an early feedback on the security of the Infrastructure as Code (IaC) templates with every commit they are making to the code.
Prancer Enterprise Cloud Compliance repository has more than 1000 policies both on the Infrastructure as Code (IaC) Security and post-deployment resources. This unique Cloud compliance policy repository is the most significant contribution to the open-source community based on the de facto Rego policy language.
IaC Security policies cover Azure, AWS and Google Clouds. Kubernetes Objects are also supported in the IaC Security. Post-deployment security scans based on these cloud providers help businesses to increase cloud security posture and maintaining security in the cloud.

As more companies begin to rely on cloud technologies, they are also looking for ways to apply compliance to their cloud environment easily and make it a secure place for their workloads. Prancer Platform helps companies to leverage security throughout the lifecycle of their cloud deployment. Prancer Platform integrates into DevOps pipelines and provides IaC Security scan.

About Prancer
Prancer Enterprise ( https://www.prancer.io) provides a pre-deployment and post-deployment multi-cloud security platform for Infrastructure as Code (IaC) and live cloud environments. It shifts the security to the left and provides end-to-end security scanning based on the Policy as Code concept. DevOps engineers can use it for static code analysis on IaC to find security drifts and maintain their cloud security posture with continuous compliance features.

# data[].attributes.attachment_link.title
Cloud Compliance Repository | Iac Security And Continuous Compliance

# data[].attributes.attachment_link.description
March 4th 2021, San Diego, CA - Prancer Enterprise is announcing that its entire cloud compliance policies repository is now open source. The repository is available on GitHub at https://github.com/prancer-io/prancer-compliance-test This move reflects Prancer's commitment to open source technology and harness the power of community collaboration to move great ideas through the pipeline faster.

# data[].attributes.attachment_link.title
Security Validation as Code - Prancer Cloud Security Platform

# data[].attributes.attachment_link.description
Cloud applications demand security validation to guarantee that the software is safe and compliant with security standards. It also aids in the prevention of data breaches and other threats prevalent to the public cloud. In the past, security validation was typically done manually by security analysts. This was time-consuming and error-prone.

# data[].attributes.attachment_link.readable_text
San Diego, CA, September 20, 2022 - Prancer Enterprise, a visionary cloud security startup specializing in offensive and defensive security tools, announced today the release of the Zero Trust Security Validation Service technology. The solution verifies and validates an organization's complete technological infrastructure and application within its zero trust policies. Then it generates a comprehensive security report on the Zero Trust Security posture of the organization.

As enterprises adopt zero trust models, they develop applications that are internet-facing and designed with default "deny access" policies. There are many tools available in the market to implement Zero Trust security. But when it comes to the validation, no automated tool can do the security validation of a zero trust implementation. This is where Prancer Enterprise's Zero Trust Security Validation Service comes into the picture. The solution offers a complete and comprehensive security validation of an organization's technology stack and provides a detailed report on the Zero Trust Security posture.

Prancer uses its patented Pentesting as Code (PAC) framework to do the security validation of a Zero Trust implementation. The PAC framework is a code-driven security testing methodology that automates the entire process of offensive security testing. The Pentesting as Code (PAC) solution covers the entire spectrum of Zero Trust implementation from networking, identity/access management, data security and application security. A wide range of zero trust policies is included in the PAC framework to support this initiative.

"As more and more businesses move to the cloud, it's imperative that they adopt a Zero Trust Security approach," said Prancer CEO, Farshid Mahdavipour. "Our new service offering will help organizations to automatically validate the implementation of their zero trust security," explained Farshid. "Without this validation process, you cannot ensure if you are protected."

Prancer zero trust testing uses sophisticated toolsets to assume the contexts of both external and internal adversaries. Current agent-based dynamic application security testing (DAST) tools that rely on fixed contexts may not be able to identify all potential attack scenarios, especially when testing zero trust applications at scale. With this new release, Prancer Cloud Security Solution is equipped with features to do the offensive scanning of a zero-trust implementation:

Validates the implementation at different layers, including assuming different zero trust identities, contextual findings and attack emulation against various company assets.

Flexible enough to take multiple contexts and contracts to validate the "deny and allow" lists.

Includes contextual access policies such as client certificates / MTLS or O-Auth tokens (vital for apps to determine data access)

On the attack emulation side, Prancer's Pentest As Code ( PAC) framework intuitively delivers threats as code. It provides simple interfaces incorporating bespoke pentesting scripts to simulate a wide range of attack types, including 1.)white-box, 2.)black-box, 3.)in-network, and 4.)out-of-network testing.

It also allows users to emulate automated and controlled attacks using a fully automated and managed service.

These new features are available immediately to clients who need to validate their Zero Trust Security measures. To learn more about Prancer Enterprise's zero trust validation service, please visit: https://www.prancer.io/zerotrust/
About Prancer
Prancer is the industry's first cloud-native, self-service SAAS platform for automated security validation and penetration testing in the cloud. Prancer provides a comprehensive suite of Code security and penetration testing as code (PAC) solutions to enable shift-left approaches to implement preventative controls and offensive security testing mechanisms. Prancer Cloud Security Solution allows you to rapidly validate at scale your cloud applications against ever-growing, sophisticated purpose-built cyber threats. The results of implementing Prancer are 1.)faster release cycles, 2.)higher reduction of false-positive findings, and 3.)greater overall cost savings for both security and engineering teams. For more information, visit https://www.prancer.io/

# data[].attributes.attachment_link.title
Prancer Enterprise announces today the release of the Zero Trust Security Validation Service offering - Prancer Cloud Security Platform

# data[].attributes.attachment_link.description
San Diego, CA, September 20, 2022 - Prancer Enterprise, a visionary cloud security startup specializing in offensive and defensive security tools, announced today the release of the Zero Trust Security Validation Service technology. The solution verifies and validates an organization's complete technological infrastructure and application within its zero trust policies.

# data[].attributes.attachment_link.readable_text
March 4th 2021, San Diego, CA - Prancer Enterprise is announcing that its entire cloud compliance policies repository is now open source. The repository is available on GitHub at
https://github.com/prancer-io/prancer-compliance-test
This move reflects Prancer's commitment to open source technology and harness the power of community collaboration to move great ideas through the pipeline faster.
These compliance policies that focused on IaC Security and live cloud resources are based on CIS, NIST 800, PCI, HIPPA, HITRUST, CSA CCM and ISO 27001 compliance standards. These policies are all in REGO Open Policy Agent (OPA) language.

Prancer Enterprise platform helps companies achieve end-to-end security in the cloud by shifting security to the left and apply it early in the development process. Cloud DevOps engineers could have an early feedback on the security of the Infrastructure as Code (IaC) templates with every commit they are making to the code.
Prancer Enterprise Cloud Compliance repository has more than 1000 policies both on the Infrastructure as Code (IaC) Security and post-deployment resources. This unique Cloud compliance policy repository is the most significant contribution to the open-source community based on the de facto Rego policy language.
IaC Security policies cover Azure, AWS and Google Clouds. Kubernetes Objects are also supported in the IaC Security. Post-deployment security scans based on these cloud providers help businesses to increase cloud security posture and maintaining security in the cloud.

As more companies begin to rely on cloud technologies, they are also looking for ways to apply compliance to their cloud environment easily and make it a secure place for their workloads. Prancer Platform helps companies to leverage security throughout the lifecycle of their cloud deployment. Prancer Platform integrates into DevOps pipelines and provides IaC Security scan.

About Prancer
Prancer Enterprise ( https://www.prancer.io) provides a pre-deployment and post-deployment multi-cloud security platform for Infrastructure as Code (IaC) and live cloud environments. It shifts the security to the left and provides end-to-end security scanning based on the Policy as Code concept. DevOps engineers can use it for static code analysis on IaC to find security drifts and maintain their cloud security posture with continuous compliance features.

# data[].attributes.attachment_link.title
Cloud Compliance Repository | Iac Security And Continuous Compliance

# data[].attributes.attachment_link.description
March 4th 2021, San Diego, CA - Prancer Enterprise is announcing that its entire cloud compliance policies repository is now open source. The repository is available on GitHub at https://github.com/prancer-io/prancer-compliance-test This move reflects Prancer's commitment to open source technology and harness the power of community collaboration to move great ideas through the pipeline faster.

# data[].attributes.attachment_link.readable_text
In today's business landscape, cloud security is more important than ever. However, the cloud introduces a new level of complexity which can create significant risk:

1. Too many surfaces to defend

2. Too many tools and siloes between teams

3. Too little context about infrastructure, apps, and data.

This complexity makes it difficult to secure the organization's most important assets: their data. The best way to combat these risks? Simplify your organization's cloud security posture!
Challenge 1 - Too many surfaces to defend
The first challenge is the sheer number of surfaces that must be defended. In the past, organizations only had to worry about securing their on-premises infrastructure. And usually, they would do that with a perimeter network design. However, with the cloud, organizations must now secure their data in a dynamic exchange between cloud storage, transit, and use. The opportunities for attackers are immense.

Organizations are started to leverage a Zero Trust design of their cloud infrastructure. Zero Trust design is about giving each user, application, and device the same level of scrutiny. This means there is no longer a "trusted" or "untrusted" network. All networks are treated as untrusted, and all users, applications, and devices must be authenticated...and authorized...before they can access data or resources. This concept makes it more difficult for companies to leverage and validate their design.
Challenge 2 - Too many tools and siloes between teams
The number of tools and siloes between teams has led to a lack of coordination between these teams. This can lead to a situation where each team uses different tools, leading to difficulties in reporting, tracking and auditing.

Organizations run an average of six different tools or features to secure their public cloud environments. Despite this multiple tool implementation, 96% of decision-makers still report that their organizations faced security incidents in the last 12 months:

1. 45% of businesses have experienced a cloud-based data breach or failed audit over the past year (2022 Thales Cloud Security Study)

2. Between 2020 and 2021, ransomware-related data leaks increased 82% and interactive intrusion campaigns increased 45%.

More tools result in a fragmented view of your overall cloud environment and various risk assessments....it does not necessarily provide a higher security posture.
Challenge 3 - Too little context about infrastructure, apps and data
Different tools for each domain can increase the visibility in that specific domain but can lead to the lack of context and correlation of findings. It is very hard and time-consuming for security professionals to prioritize risks correctly and efficiently. Also, it is difficult to understand the relationship between different systems and data. This can make it difficult to identify malicious activity and respond to incidents in a timely manner.
What is the solution?
The solution to these challenges is to 1.)simplify your organization's needs, 2.)reduce the number of tools they are using and 3.)increase the visibility and context of their data.

One way to simplify your organization's security posture is to validate your cloud security from an attacker's viewpoint, especially continuously validating the security posture of the cloud with offensive tools from an attacker's perspective. These offensive (attacker perspective) tools will provide you a comprehensive (continuous, scalable, multiple cloud locations) overview of how strong your cloud security is and where attackers can exploit potential weaknesses.

This approach will allow organizations to prioritize and fix their highest risk priorities that can cause serious damage to their reputation and integrity.

# data[].attributes.attachment_link.title
Three main challenges of Cloud Security - Prancer Cloud Security Platform

# data[].attributes.attachment_link.description
In today's business landscape, cloud security is more important than ever. However, the cloud introduces a new level of complexity which can create significant risk: Too many surfaces to defend Too many tools and siloes between teams Too little context about infrastructure, apps, and data.

# data[].attributes.attachment_link.readable_text
Cloud technology has expanded business capabilities across all industries. However, taking full advantage of the cloud means paying attention to compliance issues that can vary according to your industry and other factors. Without a stringent cloud compliance system in place, you could be making both your business and your customers vulnerable to data breaches and other security-related problems. That is why it is important to have a general understanding of cloud compliance along with a deeper understanding of what it means to your business in particular.

Essentially, cloud compliance means that any cloud-delivered system must be compliant with standards that are specific to each customer. For example, healthcare facilities have to comply with HIPAA standards, which are designed to protect the patient's privacy. HIPAA has strict guidelines concerning how patient data is stored and shared. As a result, any cloud system will need to enact security protocols that will allow cloud systems to effectively comply with HIPAA standards.

It is important to note that compliance is often an ongoing challenge. Security threats are not static and new vulnerabilities can become exposed as technology changes and hackers look for new ways to infiltrate systems. In addition, emerging industry standards and new government regulations can require a constant reassessment of compliance issues in order to stay up-to-date.

Many companies are dealing with the challenges of cloud compliance by creating new positions or outsourcing their compliance issues to specialized companies. Chief Compliance Officers are being assigned to oversee compliance-related challenges and prevent any mistakes. At the same time, companies are looking to free up their IT team and allow them to focus on other areas of the business by hiring outside companies to deal with cloud compliance. These companies are tasked with understanding the industry and all relevant compliance standards. For industries with more complex compliance issues that are subject to change, outsourcing can be an invaluable tool.

Basics of Cloud Compliance

While the exact details of cloud compliance will vary, there are some essential keys to success that should help form any basic approach.

1. Be aware of the guidelines. First and foremost, any cloud compliance plan should be addressing the latest regulations on a local, national, and international level.

2. Implement access control policies. It is important to designate who has control over what information and put in certain protections to make sure that unauthorized users can't access certain areas of the system. Typically, this means a multi-factor authentication process. While a single-sign-on system can be faster and more convenient, it creates unnecessary vulnerabilities.

3. Understand data storage. Data should be properly classified and stored in different areas according to the level of protection needed to adhere to cloud compliance standards.

4. Encryption. Encrypting data is an essential tool that adds another layer of protection to your most sensitive data. Even if there is a breach and an unauthorized user gains access to data, they won't be able to do anything with the information if it is encrypted.

Common Compliance Standards

While there are a variety of compliance standards, here are some of the most common regulations that may affect your business and how you approach cloud security:

No matter what industry you are a part of or how big your business is, cloud compliance is an important issue that requires vigilance. Fortunately, there are options when it comes to ongoing compliance support. Prancer provides a cloud validation framework that can effectively test for compliance and offer solutions in an ever-changing environment. Instead of a one-time solution, you can establish a partnership with cloud validation experts who will keep you up-to-date as laws and regulations change and so that you can take full advantage of cloud technology while ensuring optimal security and compliance. Contact us today to learn more and get started.

# data[].attributes.attachment_link.title
Cloud Compliance | Understanding Cloud Compliance and Why it Matters

# data[].attributes.attachment_link.description
Cloud technology has expanded business capabilities across all industries. However, taking full advantage of the cloud means paying attention to compliance issues that can vary according to your industry and other factors.

# data[].attributes.attachment_link.readable_text
Offensive Security is a term used to describe the art of attacking and exploiting cyber systems. It is a broad field covering many different areas, including infrastructure security, application security, database security, etc.

Offensive Security tools are used by ethical hackers and penetration testers to test the security of systems and applications. The pentester must understand the application components to formulate the attack he wants to do. Also, the more information they have about the underlying technologies, the attacker can better develop the attack.

There are several open-source and commercial tools for offensive security. Two of the most popular tools in Offensive Security are:

Zaproxy: The ZED Attack Proxy (ZAP) is a powerful open-source penetration testing tool that security experts employ to identify vulnerabilities in web applications. In a nutshell, zap intercepts and examines messages that are sent between a browser and a web application, modifying the contents if necessary and then passing them on to the destination. Zap may be used in numerous pentesting situations, including as part of the OWASP top 10 web and API testing.

Burp Suite: Burp suite is a commercial integrated platform for performing security testing of web applications and APIs. It consists of several tools that allow the pentester to map the application, find vulnerabilities, and exploit them. Burp's tools can be utilized in numerous ways to perform security testing tasks ranging from very simple to highly advanced and specialized.

There are many more tools to choose from, such as nmap, nslookup/dig, Selenium, Nikto, recon-ng, SpiderFoot, etc.
Offensive Security at scale
Manual pentesting may be more time-consuming and expensive than developing an automation suite. There are numerous tools available that can automate the majority of pentest activities, including security scanning against cloud architectures built on microservices and APIs. In turn, this ability to automate time-consuming manually intensive operations allows businesses to speed up their validation process while also reducing product release cycles

When it comes to the amount of data that can be stored, as well as the sheer scale of cloud CSPs, companies simply cannot keep up with the speed of innovation and the overall scale of the cloud. The only way to catch up with these factors is to automate the security testing as part of SDLC processes.
Prancer Automated offensive Security tools
Prancer's Penetration Testing As Code Framework (PAC) is a cloud-based solution that automates the scaling of penetration testing use cases and the creation of pentest instances on all major cloud providers.

PAC is a powerful offensive security tool that makes performing large-scale distributed penetration tests on cloud infrastructure and apps simple. It's designed for pentesters, developers, and security experts to simplify the process of detecting cloud environment vulnerabilities by automating them. PAC can be used to test serverless architectures, microservices, and APIs.Instance-based malware detection delivered a fully managed service and was deployed with minimal infrastructure in a serverless style, allowing developers, security experts, and pentesters to programmatically define threats as code and automatically discover vulnerabilities in cloud apps.

Developers may profit greatly from PAC. Developers may design an attack as code and obtain valuable feedback on the security of their application since PAC provides a fully automated and managed pentest experience with limited pentesting expertise. Developers can use PAC to identify vulnerabilities early in the development lifecycle, implement security best practices, and build secure applications by detecting flaws early on.

PAC also benefits security experts. It provides a highly versatile pentest experience with a slew of features and functions. Because PAC obtains information from the Prancer CSPM solution, it can white box cloud application pentesting and minimize false positives considerably by co-relating the infrastructure and application findings.
Conclusion
Whether you're a pentester or a developer, there are several advantages to employing automated offensive security tools like Prancer for cloud environments. With their capacity to scale and automated end-to-end security testing and validation at scale, you can dramatically improve the release velocity while delivering attack-ready cloud applications.

# data[].attributes.attachment_link.title
Prancer for Offensive Security Testing - Prancer Cloud Security Platform

# data[].attributes.attachment_link.description
Offensive Security is a term used to describe the art of attacking and exploiting cyber systems. It is a broad field covering many different areas, including infrastructure security, application security, database security, etc. Offensive Security tools are used by ethical hackers and penetration testers to test the security of systems and applications.

# data[].attributes.body
Introduction

Cloud applications demand security validation to guarantee that the software is safe and compliant with security standards. It also aids in the prevention of data breaches and other threats prevalent to the public cloud.

In the past, security validation was typically done manually by security analysts. This was time-consuming and error-prone. With the rise of DevOps, there is now a better way to do security validation. Security Validation as Code is a new approach that uses automation to validate the security of cloud applications. In this post, we are reviewing a quick background on the subject and highlighting the benefits of Security validation as code.

Challenges with manual Security Validation in the cloud

The majority of the time, security validation is a manual operation. It lacks the repeatability and process hygiene associated with SDLC. In the CI/CD world, the existence of a manual security testing procedure creates significant operational inefficiencies. Moreover, It is difficult to manage and organize security testing across different environments.

Because security testing tools are not always integrated with the application development tools and processes, the results of security testing can be difficult to track and trace back to the source code. It would be difficult to reproduce security issues.

API driven testing to the rescue

The vast majority of modern cloud-native applications and their infrastructure are API-driven. Because every fabric of the cloud is expressed using a consistent interface and atomicity, it is possible to represent most current cloud security validation as code, completely driven by APIs. This allows for more accurate and efficient testing.

By using APIs to drive the testing process, you can better mimic how the application will actually behave when it is used in production. This can help you find and fix problems before they cause issues for your customers.

What is Security Validation as Code?

Security Validation as Code enables validation of cloud applications and infrastructure in a more automated and API-driven way. It uses the same techniques and tools that are used for other types of testing, such as unit testing, integration testing, and regression testing. But all the security tests would be codified and kept in code repositories. To have the Security Validation as Code implemented for your company, you need to have a framework or a processing engine that can validate the cloud applications against the security tests which are available in a code repository and report back the non-compliant resources to the process.

The benefits of Security Validation as Code

Validation as code strives to minimize these barriers. With Security Validation as Code, security experts can define security tests in codes. The codes are shared between multiple parties and applied in various environments. your tests would have repeatability and you can get consistent results across different environments.

With Security Validation as Code, you can marry the speed of the CI/CD process with the high-quality bar of security. You can make sure if the pipeline is completed successfully, all the security tests are passed and the application is ready to be launched.

Security validation as code is also more scalable than manual testing and can be easily integrated into existing processes and tools. Your current SDLC process could have an extra step to security validate the application and environment to make sure all the configurations and codes are under compliance.

What are the challenges of Security Validation as Code?

The biggest challenge with Security validation as code is to find the proper solution that can run the security tests your company is looking for. You need to find a tool that can be easily integrated into the process and read the codes from the repositories.

Also, companies prefer to have a set of ready-to-use out-of-box test cases to run against their applications and environments, rather than developing the security test cases and threat vectors from scratch. This is the problem space Prancer’s PAC attempts to solve. Prancer automatically learns your cloud eco-system and automates the security validation, penetration testing and infrastructure vulnerability assessments.

Security Validation as code is still a relatively new concept, and there aren’t many solutions that provide it. However, we anticipate to see more solutions appear in the near future, as more businesses recognize the value of automating their security testing procedures.

If you’re interested in implementing Security Validation as Code for your cloud applications, sign up for Prancer Platform!

# data[].attributes.attachment_link.readable_text
Cloud security testing is still a relatively new practice although it has advanced by leaps and bounds over the past few years. In the early days of cloud computing technology, security was still handled through traditional methods that tended to be time consuming and weren't as responsive to a highly scalable environment. As a result, cloud security evolved in order to better support cloud based applications and keep pace with business. Today, cloud security testing is more effective and convenient than ever before. Keep reading to learn how cloud security testing has grown and what we can expect in the future.

The Evolution of Cloud Security Testing

Traditional security testing relied on on-premise tools, including IT professionals who would have to test for known threats while also trying to monitor for emerging challenges. This was a time-consuming approach that created bottlenecks when it came to development and deployment. New applications would be stalled while security issues were addressed.

In response to these issues, security testing was also moved to the cloud. This method incorporates scanning tools that can detect abnormalities and alert the relevant parties so that they can take action. While this isn't a foolproof system, it does allow for CI/CD without slowing down the pipeline.

How Cloud Security Testing Works

Basically, you have an environment which is built on your choice of cloud provider. From there, you may need to provide information about authentication requirements and functionality expectations. This expectation could be in the form of one of well known compliance standards. You can also take other steps to customize the compliance tests to make sure that it is scanning for specific concerns that are related to your business. Once you initiate the test, the scanner will go to work detecting any potential problems and providing you with a detailed report. This is a quick and easy way to test cloud environments against known threats and challenges.

What to Look for in a Cloud Security Testing Tool

As you explore how to approach cloud security testing and which tools are right for you, here are some things to take into consideration:

1. Comprehensive - you want a scanner that offers a comprehensive set of compliance tests and the ability to put new tests in the scanner based on the unique needs of your business.

2. Speed - you want a scanner that offers fast performance so that you can continually run tests as changes are made to various applications. This is key to adequately supporting the development process and avoiding delays due to security concerns.

3. Reporting - look for solutions that provide detailed reports along with actionable suggestions for resolving any problems. This automation and information is key to improving security in a way that keeps pace with cloud technology.

4. Scalability - one of the main advantages of cloud technology is scalability and flexibility. Any effective security testing tool will have these same qualities.

5. Availability - business happens on a 24/7 lifecycle, especially as it becomes more globalized. Security testing solutions need to keep that same schedule and be available at any time.

6. Value - cloud security testing will need to be continuous and involve multiple iterations. That is why you want a cost-effective option that will support this strategy without eating away at your IT budget.

Today's cloud security testing tools are able to support cloud technology and CI/CD in new and exciting ways. Security testing is allowing businesses to take full advantage of cloud computing, free up time to IT professionals and allow for more collaborative relationships between security and development teams. If you are still relying on traditional security testing methods, now may be the time to consider incorporating cloud-based security testing tools.

To learn more about cloud testing, validation, and security, contact the experts at prancer. We are happy to answer your questions and help you find the right solutions for your business.

# data[].attributes.attachment_link.title
Cloud Security Testing | Learn about Cloud Security Testing

# data[].attributes.attachment_link.description
Cloud security testing is still a relatively new practice although it has advanced by leaps and bounds over the past few years. In the early days of cloud computing technology, security was still handled through traditional methods that tended to be time consuming and weren't as responsive to a highly scalable environment.

# data[].attributes.attachment_link.title
How Prancer protects Azure VMs from Critical “OMIGOD” vulnerabilities - Prancer Enterprise

# data[].attributes.attachment_link.description
Wiz.io, a security research firm, recently found four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI) framework. With these OMI vulnerabilities, hackers could use them remotely to gain root access on Linux servers running on the Azure cloud and enable them to take control of your…

# data[].attributes.attachment_link.embed_code
How Prancer protects Azure VMs from Critical “OMIGOD” vulnerabilities

# data[].attributes.attachment_link.readable_text
There are different configuration items and files available in the Prancer framework. The Prancer framework is at the heart of the Prancer Platform. The different configuration files available in the Prancer framework are as follows:

Connector

Master Snapshot Config file

Snapshot Config file

Master Compliance test file

Compliance test file

How does Prancer Framework operate in its most basic components?
The main configuration file is the connector, which is used to connect to different providers. It could be a cloud provider or a git provider. A connector encompasses enough information to connect to the supported external API providers. In the case of the git repository, it's got the address of the git repository, the credentials, and the branch name. In the case of the cloud, it contains the required way to connect to the cloud, the iam user, secrets, and such information. The cloud could be any cloud supported by prancer - Azure ,AWS or GCP.
Snapshot Configs
The Master Snapshot Config file contains the type of resource to get the configurations out of them , i.e. in the case of Azure, it could have the information to get all the virtual machines, all the vnets, or all the security groups. Master Snapshot configuration file cares about the types of resources from the cloud provider. In the case of the git, it could be to get all the JSON files, all the YAML files, all the terraform files, which again are types of resources being looked for. All the details to connect to various resource types are stored in the Master Snapshot Config file.

Inside the Prancer framework, there's a crawling engine (a feature called crawler), which connects to the external provider using the connector, and based on the configuration that is present in the Master Snapshot Config file, it can find all the resources in the external provider, and generate another file called a Snapshot Config file.

In the Snapshot Config file, there are individual resources, unlike the Master Snapshot Config file, which contains the type of resources that we wish to get information about, e.g. when asking for virtual machines from the external provider, the crawler crawls the external provider resources and finds all the virtual machines present, for instance, vm-1, vm-2, vm-3, up until vm-10. In the case of git for IaC, the crawler connects to the git repository, based on the Master Snapshot Config file, which asks for all the YAML files, so the crawler finds all the individual YAML files in the git repository and generates a Snapshot Config file for the individual files that are available.
Tests and compliance tests
Another configuration file available in the Prancer frameworks is the Master Test file,which contains enough information to run tests against the type of resources that are present. For example, checking if all the virtual machines are using a public IP address, or testing all security groups and checking if they are using port 22 to allow an inbound SSH connection. All these test cases are stored in the Master Test file

On another side, we have the test file. A test file is related to individual resources. When the crawling feature is used, the test file is not being used, but when individual resources are used rather than the crawling feature, a test file is used for individual tests.
How all of these configuration files work together
Prancer framework uses the connector to connect to an external provider. The Crawler feature uses the Master snapshot configuration file to find all the resources mentioned in the master snapshopt configuration file and generate the snapshot configuration file which contains individual resources. Then the framework will generate Snapshots, which are the confirmation of the resources we want to keep for testing. Then the Compliance Engine can start running the testcases against the resources available as the snapshot, The tests and the compliance on these snapshots are run based on the master tests, and understood if those resources are compliant or not.

while running the testcases against the available snapshots, an output file is being generated which contains the report we are looking for. if the resource is passed or failed and the related compliance testcases. All the reporting details needed are available in the output file.

This process consisting of crawling and compliance tests can be run as many times as needed - based on the changes occurring in the cloud. All these configs and output files are stored in a container folder which is called Collection. We can have as many Collections as required for our testing purposes.

The Collection is a very powerful feature. We can use the Collection concept for various purposes. We can have a collection based on each project, based on each customer, or based on each business unit (based on how the user would like to interpret the collection in their specific business area).

A collection is basically like a folder that encompasses all these items. In the Prancer framework, there can be multiple collections, like a collection for Azure, one for AWS, one for the GitHub repository, one for a specific project in the git, and so on. Also, in each collection, there could be multiple connectors, multiple master snapshot config files, multiple master test files. It's not restricted to a single file for each type seen here.

The concept of Collection gives the user a very powerful mechanism to scale up their security posture based on the prancer framework.
Remote Configuration files
Prancer Framework supports two types of test formats. The simple testcases which are an inhouse query language on JSON files, and also tests based on the Open Policy Agent (OPA) Rego policy language, All the Rego test files are also available in the same collection, e.g. if there are 100 test cases based on the Rego, the files are available in the same collection directory. That's how the people working with the Prancer framework do the compliance test.

Suppose there are multiple Collections available for the company and the user wants to centralize the management of test files, Rego files, and snapshot files. It is possible to store all of these items in a remote git repository and read them from a centralized location. In this case, instead of creating the full Master test files and Master snapshot configuration files, 2 pointers are employed - a Master Snapshot Config pointer and a Master Test file config pointer - which point to the remote git which reads the information and gives the user the ability to leverage the power of Policy as Code and centrally manage the master test files, Rego files, and also the Master Snapshot Config files. The process for running the Prancer framework would be the same but instead of having a local Master Snapshot config, it connects to the remote git and gets the information from the remote master snapshot. And at the time of testing, the Compliance Engine connects to the remote master test files and the remote Rego files rather than the local files, but everything else like the snapshot and outputs will be stored locally in the collection.

In this article, I have introduced various configuration files available in the Prancer Framework, which is the heart of Prancer Platform. By understanding these concepts, you have an easier time navigating through our solution and understand the details of the application.

# data[].attributes.attachment_link.title
What are the Configuration files in the Prancer framework? - Prancer Enterprise

# data[].attributes.attachment_link.description
There are different configuration items and files available in the Prancer framework. The Prancer framework is at the heart of the Prancer Platform. The different configuration files available in the Prancer framework are as follows: Connector Master Snapshot Config file Snapshot Config file Master Compliance test file Compliance test file How does Prancer Framework operate in its most basic components?

# data[].attributes.attachment_link.readable_text
San Diego, CA - Sept 1st 2021 - Prancer Enterprise, a cloud security startup focused on the Static Code Analysis (SCA) for Infrastructure as Code (IaC), announces significant expansions to its compliance test cases. These new test cases are mainly for the cloud Platform as a Service (PaaS) offering and extend toward Microsft Azure, AWS Cloud, and Google Cloud Platform (GCP). With these new compliance test cases, Prancer Enterprise now maintains the most extensive open source Infrastructure as code (IaC) test cases for static code analysis based on the compliance standards. Prancer Enterprise maintains an open-source repository for all the Infrastructure as Code (IaC) test cases based on industry-standard Open Policy Agent (OPA) Rego policy language. The repository is publicly available at the following GitHub address: https://github.com/prancer-io/prancer-compliance-test

For the Azure IaC, these updated test cases include Azure Kubernetes Services, Redis Cache, DataBricks, MariaDB, MySQL, and PostgreSQL. New and updated test cases for AWS include API Gateway, Code Deploy, Code Pipeline, AWS Config, Database Migration Service, Elastic Container Registry, Elastic Container Service, Elastic Kubernetes Service, Elastic Cache, Key Management Service, Elastic MapReduce, and IAM. All of these new and updated IaC compliance test cases are available at the Prancer GitHub repository.

Prancer Cloud Security platform supports all the widespread Infrastructure as Code (IaC) templates. Cloud-native IaC templates include Azure ARM templates, AWS Cloud formation, and GCP deployment files. Moreover, third-party solutions like Terraform are also supported. Supporting these various IaC templates ensures that DevOps teams can choose their IaC language and still benefit from Prancer Platform for their cloud security requirements. Prancer platform is an essential tool for DevSecOps implementations by doing automated testing on IaC templates and promote a shift-left mindset.

Prancer cloud security platform is the only solution for IaC Static code analysis that can check Kubernetes Custom Resource Definitions files for the cloud. These new formats include Azure Service Objects (ASO) for Kubernetes, AWS Controllers for Kubernetes (ACK), and Google Kubernetes Config Connector (KCC). These new emerging formats are getting popular among DevOps engineers and are supported by all the major cloud providers. These promising IaC formats could resolve many shortcomings of the current solutions. Prancer platform also supports Kubernetes native deployment files and Helm charts. The list of supporting iaC templates is also growing to support all the IaC formats.

About Prancer

Prancer Enterprise (https://www.prancer.io) provides a pre-deployment and post-deployment multi-cloud security platform for Infrastructure as Code (IaC) and live cloud environments. It shifts the security to the left and provides end-to-end security scanning based on the Policy as Code concept. DevOps engineers can use it for static code analysis on IaC to find security drifts and maintain their cloud security posture with continuous compliance features.

# data[].attributes.attachment_link.title
Prancer Enterprise announces a significant expansion in its Infrastructure as Code (IaC) compliance test cases - Prancer Enterprise

# data[].attributes.attachment_link.description
San Diego, CA - Sept 1st 2021 - Prancer Enterprise, a cloud security startup focused on the Static Code Analysis (SCA) for Infrastructure as Code (IaC), announces significant expansions to its compliance test cases. These new test cases are mainly for the cloud Platform as a Service (PaaS) offering and extend toward Microsft Azure, AWS Cloud, and Google Cloud Platform (GCP).

# data[].attributes.attachment_link.readable_text
Prancer Cloud Security Platform is built based on the core Prancer framework codebase (https://github.com/prancer-io/cloud-validation-framework). Prancer Framework leverages the well-architected concepts for scalability and extendability.

Prancer Framework uses various Configuration files to complete the security scanning of the resources available in an external provider (Cloud, Git, K8s). Here are a brief introduction to these configuration files:

Connector: Connector config files store the required information to connect to an external provider. Depends on the type of the external provider, the structure of the Connector file could be different.

Master Snapshot Configuration file: in this file, we store the type of resources we want to crawl. In the IaC realm, we can put enough information inside the Master Snapshot Config file to crawl all the files we are looking for (json, yaml, terraform,...) . In the Cloud live examples, we can ask for all the Virtual Machines inside our cloud provider!

Snapshot Configuration File: Prancer crawler engine uses the Master Snapshot Configuration file to find individual resources in the target environment. file1.yaml, file2.yaml could be items in the Snapshot Config file

Master Test File: the compliance tests we want to run on each type of resource available in the Master Snapshot Config file

Test file: the compliance tests related to individual resources

to understand more about how these files all work together, you can watch the following video:

# data[].attributes.attachment_link.title
An Introduction to Prancer Framework Configuration Files - Prancer Enterprise

# data[].attributes.attachment_link.description
Prancer Cloud Security Platform is built based on the core Prancer framework codebase (https://github.com/prancer-io/cloud-validation-framework). Prancer Framework leverages the well-architected concepts for scalability and extendability. Prancer Framework uses various Configuration files to complete the security scanning of the resources available in an external provider (Cloud, Git, K8s).

# data[].attributes.attachment_link.readable_text
Microsoft program accelerates the trajectory of startups growth and scale

San Diego, CA - July 27th 2021 - Prancer Enterprise, a leading cloud security validation company that provides Shift-Left security tools to empower developers, today announced its induction into Microsoft for Startups, a global program dedicated to accelerating the trajectory of high-potential startups to enable growth at scale. As a program member, Prancer Enterprise will have exclusive access to Microsoft technology, mentorship and business support.

Prancer Enterprise ( https://www.prancer.io) provides Static Code Analysis for Infrastructure as Code (IaC) and post-deployment validation for live cloud environments. It shifts the security to the left and provides end-to-end security scanning based on the Policy as Code. DevOps engineers can use it for static code analysis on IaC to find security drifts and maintain their cloud security posture with continuous compliance features. Prancer Enterprise can easily be integrated into various Continuous Integration (CI) tools, including GitHub Actions and Microsoft Azure DevOps.

"Prancer Enterprise mission to address an unresolved problem in one of the fastest-growing segments of the Cloud Security industry is a great fit for the program. We look forward to helping Prancer Enterprise deliver their innovative solution to our joint customers," said Raz Bachar, Managing Director, Microsoft for Startups

Prancer Enterprise cloud security platform comes with more than 800 built-in policies. The security compliance policies available out of the box can detect the misconfigurations of code with every commit the engineer is making to the repository. It also can provide automatic remediation on the code and file a Pull Request (PR) on behalf of the user to fix the security issue. This increases the speed of deployment while maintaining high-security standards. SecOps teams can make sure all of their policies are in place and the IaC template is verified and validated before even the provisioning process starts. Prancer Enterprise supports major cloud providers and IaC languages, including Azure ARM templates, Azure Service Operator for Kubernetes and Terraform.

Prancer Enterprise uses Azure to reach a wide-scale audience in a short time, with built-in redundancy and security. The whole infrastructure runs on Azure and is secured by built-in Azure features. The solution is based on Microservices architecture and benefit from many Platform as a Service (PaaS) Azure resources for scalability, resiliency and security.

"We're honored to be among such a select group of companies from around the world chosen to join the Microsoft for Startups program, and we plan to leverage this amazing opportunity to its fullest," said Farshid Mahdavipour, founder and CEO at Prancer. "Our participation in the program comes at a critical time for our company as we launch our new Shift-Left security toolset for customers."

"Prancer Enterprise mission to address an unresolved problem in one of the fastest-growing segments of the Cloud Security industry is a great fit for the program. We look forward to helping Prancer Enterprise deliver their innovative solution to our joint customers," said Raz Bachar, Managing Director, Microsoft for Startups at Microsoft.

About Prancer
Prancer Enterprise ( https://www.prancer.io) provides a pre-deployment and post-deployment multi-cloud security platform for Infrastructure as Code (IaC) and live cloud environments. It shifts the security to the left and provides end-to-end security scanning based on the Policy as Code concept. DevOps engineers can use it for static code analysis on IaC to find security drifts and maintain their cloud security posture with continuous compliance features.

# data[].attributes.attachment_link.title
Prancer Enterprise Joins Microsoft for Startups - Prancer Enterprise

# data[].attributes.attachment_link.description
San Diego, CA - July 27th 2021 - Prancer Enterprise, a leading cloud security validation company that provides Shift-Left security tools to empower developers, today announced its induction into Microsoft for Startups, a global program dedicated to accelerating the trajectory of high-potential startups to enable growth at scale.

# data[].attributes.attachment_link.readable_text
Prancer Cloud Security Platform provides various reporting features for Infrastructure as Code (IaC) Static Code Analysis (SCA), and cloud live resources through Cloud Security Posture Management (CSPM) features.
The unified reporting feature brings these two separate worlds together and gives the user an exceptional insight into his environments and code repositories.

With this powerful unified reporting feature, it is possible to understand which resources are not incompliant. The filtering features give you the ability to narrow down your selections and also go back in time to know how your environment looked like back in the time.

You can check this youtube video to have a better understanding of the reporting function.

# data[].attributes.attachment_link.title
How to use Prancer Unified Reporting feature for IaC Static code analysis and CSPM - Prancer Enterprise

# data[].attributes.attachment_link.description
Prancer Cloud Security Platform provides various reporting features for Infrastructure as Code (IaC) Static Code Analysis (SCA), and cloud live resources through Cloud Security Posture Management (CSPM) features. The unified reporting feature brings these two separate worlds together and gives the user an exceptional insight into his environments and code repositories.

# data[].attributes.attachment_link.readable_text
Prancer is a pre-deployment and post-deployment multi-cloud validation framework for your Infrastructure as Code (IaC) pipeline that supports continuous compliance in the cloud.

Enterprise companies are building resources in the cloud at the speed of light. This makes it impossible for security operators to oversee all the details involved. Prancer cloud validation framework enforces compliance throughout the entire cloud lifecycle. It can be integrated into the company's DevSecOps process to enforce compliance on Infrastructure as Code. Also, it can connect to your cloud provider of choice to ensure continuous compliance in the cloud. With prancer, the use cases are countless and you can apply cloud compliance, ensure cloud security and certify cloud validation.

Prancer has built-in compliance tests available for your Infrastructure as Code, and Cloud. These compliance tests are based on industry standards like HIPPA, PCI, SCI and other frameworks.

Prancer provides you with the required tools and best practices to keep your Infrastructure as Code pipeline secure. Also, through the available cloud scanners, it ensures continuous security monitoring for your cloud.

Prancer offers comprehensive validation tests for your Infrastructure as Code pipeline. It can connect to multiple cloud providers and your git repositories to validate the resources in the entire pipeline.

Currently we can connect to Microsoft Azure, Amazon AWS and Google cloud platforms.

For the Infrastructure as Code validation , we can connect to any git repository and
read custom JSON formats, YAML files and plain text files and run compliance tests against them.

San Diego, CA - June 16th 2020 - Prancer, a company that provides clients with a framework to validate cloud resources, is excited to announce the launch of their very own YouTube channel. The channel provides viewers with informative videos that can be used to better...

read more

With a Man-in-the-middle (MITM) cyberattack, a third party is able to interrupt communication between and the victim and the intended receiver. This type of attack comes in many different forms that all work to deceive the victim, find vulnerabilities in cloud...

read more

San Diego, CA - July 8th 2020 - Prancer, a company that provides clients with a framework to validate resources that they deploy to the cloud, is excited to announce a long list of new features that are now a standard part of prancer cloud, their SaaS solution. These...

read more

San Diego, CA - June 16th 2020 - Prancer, a company that provides clients with a framework to validate cloud resources, is excited to announce the launch of their very own YouTube channel. The channel provides viewers with informative videos that can be used to better...

read more

With a Man-in-the-middle (MITM) cyberattack, a third party is able to interrupt communication between and the victim and the intended receiver. This type of attack comes in many different forms that all work to deceive the victim, find vulnerabilities in cloud...

read more

San Diego, CA - July 8th 2020 - Prancer, a company that provides clients with a framework to validate resources that they deploy to the cloud, is excited to announce a long list of new features that are now a standard part of prancer cloud, their SaaS solution. These...

read more

# data[].attributes.attachment_link.title
Cloud Validation Framework | Cloud Compliance | Cloud Security | Cloud Validation

# data[].attributes.attachment_link.description
Prancer is a pre-deployment and post-deployment multi-cloud validation framework for your Infrastructure as Code (IaC) pipeline that supports continuous compliance in the cloud. Enterprise companies are building resources in the cloud at the speed of light. This makes it impossible for security operators to oversee all the details involved.

# data[].attributes.attachment_link.readable_text
San Diego, CA - December 15, 2020 - Prancer, a company that provides clients with a framework to validate resources pre deployment and post deployment on the cloud, is proud to announce their feature in Enterprise Security Magazine as one of the "Top Cloud Security Solution Providers of 2020". Prancer founder, Farshid Mahdavipour, was interviewed about the company and how it is helping support companies during the pandemic as they more rapidly embrace cloud technology.

Prior to the onset of COVID-19, businesses were looking for ways to safely integrate cloud technology into their daily operations. This process has been accelerated by the global pandemic. Businesses are having to build resources in order to adapt to a new normal. Quickly provisioning and deploying new resources can create security concerns, which is where prancer comes in.

As a leader in Cloud Security SaaS solutions, prancer has developed a forward thinking and innovative multi-cloud security validation framework that supports compliance efforts. According to Mahdavipour, "We have designed our solution to allow security operators to enforce compliance throughout the entire lifecycle by helping them validate and verify cloud implementation before and after deployment."

Prancer is revolutionizing the way businesses, across all industries are navigating the cloud security, compliance and validation landscape. This latest accolade and feature in Enterprise Security Magazine marks another step in the company's rise to prominence among a crowded field of cloud security providers.

About Prancer
Prancer was created with the goal of providing any size business with a cloud security validation framework that enables cloud governance and multi-cloud validation. By understanding the needs of today's clients, creating innovative solutions and collaborating through open source networks, we are working to make cloud technology more secure and versatile.

# data[].attributes.attachment_link.title
Cloud Validation Network | Top Cloud Security Solution Providers of 2020

# data[].attributes.attachment_link.description
San Diego, CA - December 15, 2020 - Prancer, a company that provides clients with a framework to validate resources pre deployment and post deployment on the cloud, is proud to announce their feature in Enterprise Security Magazine as one of the "Top Cloud Security Solution Providers of 2020".

# data[].attributes.attachment_link.readable_text
Introduction

You can integrate prancer Platform into your DevOps process to do automated security tests on Infrastructure as Code (IaC). This post will explain how to do an IaC security scan with Prancer platform on your Azure ARM templates repository in a few steps.

High level steps

clone the Prancer Hello World repository

modify the connector file

run the tests

Interpret the results

Step 1 - clone the Prancer Hello World repository

git clone https://github.com/prancer-io/prancer-hello-world.git cd prancer-hello-world

To clone the Prancer Hello World repository and change the directory to it.

Step 2 - modify the Connector

You should modify the Connector file to point to your own git repository. The sample connector file is gitConnectorArmRemoteStructure.json.

vi gitConnectorArmRemoteStructure.json

You see the content of the file as follows:

{ "fileType": "structure", "type": "filesystem", "companyName": "prancer", "gitProvider": "https://github.com/prancer-io/prancer-armof.git", "branchName": "master", "private": false }

Change the gitProvider to point to your repository. You can find more information about the structure of this file here

Step 3 - run the tests

First, crawl your repo and then run the tests with the following commands.

prancer scenario-arm-remote --crawler prancer scenario-arm-remote

You will see the results of the tests on screen.

step 4 - Interpret the results

Prancer will generate an output file, and you can view the result of each test (Passed / Failed)

cat validation/scenario-arm-remote/output-master-test.json

Here is a snippet of the output-master-test.json file:

 { "eval": "data.rule.aks_cni_net", "result": "passed", "message": "", "id": "PR-AZR-0006-ARM", "remediation_description": "Make sure you are following the ARM template guidelines for AKS from this URL : https://docs.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters", "remediation_function": "PR_AZR_0006_ARM.py", "snapshots": [ { "id": "ARM_TEMPLATE_SNAPSHOT1", "structure": "filesystem", "reference": "master", "source": "gitConnectorArmRemoteStructure", "collection": "armtemplate", "type": "arm", "region": "", "paths": [ "/AKS/aks.azuredeploy.json", "/AKS/aks.azuredeploy.parameters.json" ] } ], "autoRemediate": false, "masterTestId": "TEST_AKS_1", "masterSnapshotId": [ "ARM_TEMPLATE_SNAPSHOT" ], "type": "rego", "rule": "file(aks.rego)", "title": "Azure CNI networking should be enabled in Azure AKS cluster", "description": "Azure CNI provides the following features over kubenet networking:_x000D__x000D_- Every pod in the cluster is assigned an IP address in the virtual network. The pods can directly communicate with other pods in the cluster, and other nodes in the virtual network._x000D_- Pods in a subnet that have service endpoints enabled can securely connect to Azure services, such as Azure Storage and SQL DB._x000D_- You can create user-defined routes (UDR) to route traffic from pods to a Network Virtual Appliance._x000D_- Support for Network Policies securing communication between pods._x000D__x000D_This policy checks your AKS cluster for the Azure CNI network plugin and generates an alert if not found.", "tags": [ { "cloud": "git", "compliance": [], "service": [ "microsoft.containerservice" ] } ], "snapshotId": [ "ARM_TEMPLATE_SNAPSHOT1" ], "status": "enable" }

It provides you all the details you need to track down the item and fix it if required.

You can easily integrate the Prancer Platform into your pipeline for automated IaC scans.

fail_success=`grep failed validation/scenario-arm-remote/output-master-test.json` pass_error=`grep passed validation/scenario-arm-remote/output-master-test.json` if [[ -z "$fail_success" ]] || [[ ! -z "$pass_error" ]] ; then echo "scenario-arm-remote failed"; exit 1;fi

References

# data[].attributes.attachment_link.title
How to do IaC Security Scan for your Azure ARM templates repo with Prancer - Prancer Enterprise

# data[].attributes.attachment_link.description
You can integrate prancer Platform into your DevOps process to do automated security tests on Infrastructure as Code (IaC). This post will explain how to do an IaC security scan with Prancer platform on your Azure ARM templates repository in a few steps.