Prisma™ Cloud Release Notes
    : Features Introduced in August 2023
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma™ Cloud Release Notes
    5. Prisma Cloud Application Security Release Information
    6. Features Introduced in 2023— Application Security
    7. Features Introduced in August 2023
    Download PDF

    Prisma™ Cloud Release Notes

    Features Introduced in August 2023

    Table of Contents

    Features Introduced in August 2023

    Learn about the new Application Security capabilities on Prisma™ Cloud Enterprise Edition (SaaS) in August 2023.
    The following new features or enhancements are available for Prisma Cloud Application Security. These capabilities help agile teams add security checks to their development process and enforce security throughout the build lifecycle.

    New Features

    FEATURE
    DESCRIPTION
    Added support for setting up Transporter network tunnels using Helm Charts
    You can now set up Transporter with Kubernetes Helm Charts. This enhancement provides increased flexibility in customizing your Transporter deployment to meet your specific requirements.
    Added support for multiple integrations across both GitLab and GitLab Self-Managed version control systems
    Added support for multiple integrations across both GitLab and GitLab Self-Managed version control systems. After the initial integration with Prisma Cloud, you can continue to add additional organizations and workspaces using a different or the same user or team token.
    Multiple integrations from a single Prisma Cloud account enables you to:
    • View a list of integrations on a single console.
    • Add additional integrations.
    • Manage integrations.
    Added support for multiple integrations across Jenkins Plugin and CircleCI CI/CD systems
    Added support for multiple integrations across Jenkins Plugin and CircleCI CI/CD systems.
    Multiple integrations from a single Prisma Cloud account enables you to:
    • View a list of integrations on a single console.
    • Add additional integrations.
    • Manage integrations.

    Changes in Existing Behavior

    FEATURE
    DESCRIPTION
    Code Security has a New Name
    Starting with 23.8.3, Cloud Application Security is the new name for the combination of the Cloud Code Security capabilities and the newly introduced CI/CD Security module. CI/CD Security is available as a standard a-la-carte option or as an add-on with the Prisma Cloud Runtime Security Foundations or Advanced bundles.
    Owing to the name change, the path to Projects, Development Pipelines and Supply Chain will now be Application Security instead of Code Security on the Prisma Cloud administrative console. The change does impact any existing workflows for scanning and fixing issues.
    New Policies for Cloud Application Security (previously Cloud Code Security)
    Starting with the 23.8.3 release, 125 new Config policies of subtype Build that enable the detection of CI/CD security risks will be enabled by default and available on the
    Policies
     page. With the release, the Code Security capabilities are being renamed as Application Security, and also will introduce CI/CD Security.
    These new policies will not generate any alerts until you enable the new
    CI/CD Security
     capability on
    Settings
    Application Security Configuration
    . When you subscribe the CI/CD Security capability, when it becomes available, the alerts will display on
    Application Security
    CI/CD Risks
    .

    Policy Updates

    POLICY UPDATES
    DESCRIPTION
    Migration of Build Integrity Policies to Configuration Build Policies
    Changes
     - The Build Integrity policies for GitHub and GitLab Terraform Providers will be migrated to IaC Misconfiguration Build policies in the next release.
    Here is the list of policies to be migrated:
    • Ensure GitHub repository is Private
    • Ensure GitHub repository has vulnerability alerts enabled
    • Ensure GitHub Actions secrets are encrypted
    • Ensure GitHub branch protection rules requires signed commits
    • Ensure Gitlab project merge requests has at least 2 approvals
    • Ensure Gitlab branch protection rules do not allow force pushes
    • Ensure Gitlab project prevents secrets
    Impact
    - You will view policy violations for these policies on Projects and Supply Chain in IaC Misconfigurations code category. Enforcement levels for IaC Misconfigurations will now be applied to pipelines with these findings.
    Build Integrity Policies -Deleted
    Changes
     - The following Build Integrity policies are no longer supported.
    • Gitlab branch protection rules allows force pushes
    • Gitlab organization has groups with no two factor authentication configured
    • GitHub Actions ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable is set to true
    • GitHub Actions Run commands are vulnerable to shell injection
    • GitHub Actions curl is being with secrets
    • GitHub Actions Netcat is being used with IP address
    • GitHub Actions artifact build do not have cosign - sign execution in pipeline
    • GitHub Actions artifact build do not have SBOM attestation in pipeline
    • GitHub Actions contain workflow_dispatch inputs parameters
    • Rules used could create a double pipeline
    • Suspicious use of curl in a GitLab CI environment
    • GitHub organization security settings do not include 2FA capability
    • GitHub organization security settings do not include SSO
    • GitHub Repository doesn’t have vulnerability alerts enabled
    • GitHub Actions Environment Secrets are not encrypted
    • GitHub merge requests should require at least 2 approvals
    • GitHub organization webhooks do not use HTTPs
    • GitHub repository webhooks do not use HTTPs
    • GitHub branch protection rules do not require linear history
    • GitHub repository has less than 2 admins
    • GitHub branch protection rules are not enforced on administrators
    • GitHub branch protection does not dismiss stale reviews
    • GitHub branch protection does not restrict who can dismiss a PR
    • GitHub branch protection does not require code owner reviews
    • GitHub branch protection does not require status checks
    • GitHub branch protection does not require push restrictions
    • GitHub branch protection rules allow branch deletions
    • Ensure container job uses a non latest version tag
    • Ensure container job uses a version digest
    • Ensure set variable is not marked as a secret
    • BitBucket pull requests require less than approvals
    Impact
    - You will not view any policy violations on Projects and Supply Chain.

    REST API Updates

    FEATURE
    DESCRIPTION
    Code Security Dashboard APIs
    Prisma Cloud Code Security (CCS) now includes the following new Dashboard endpoints that enable you to get details and metrics for Code Security related issues:

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.