5/6/2024

Announcing JUDGE in AWS Marketplace

Author: Mikhail Swift

JUDGE on AWS Marketplace
I’m excited to announce that JUDGE, our software supply chain attestation and compliance platform, is now available in AWS Marketplace.
This marks a significant milestone in our mission to provide end-to-end security coverage for software pipelines. It builds on our commitment to open source and our active participation in software supply chain security communities.
By offering JUDGE in AWS Marketplace, we’re empowering organizations of all sizes to proactively mitigate risks and fortify their CI/CD pipelines against emerging threats, all while ensuring scalability and flexibility to meet evolving security needs.
Continuous monitoring of software build pipeline trusted telemetry yields a lower residual risk of software supply chain attack and meets multiple NIST SP 800-53r5 security controls.

Availability to AWS Customers

For AWS customers, this simplifies access to our security platform, ensuring that software artifacts can securely attest to policy compliance, even in network-restricted environments.
Our customers will now have access to JUDGE directly in the AWS Marketplace. We provide prospective customers with the ability to streamline the purchase and management of JUDGE within their AWS account.

A Commercial Product Offered With Open-Source Components

JUDGE is offered alongside two open-source components: Witness, a CI/CD pipeline observer that collects trusted telemetry for attestations, and Archivista, a trusted telemetry and attestation storage manager. Originally built and maintained by TestifySec, both open-source tools were donated to Cloud Native Computing Foundation (CNCF) as subprojects underneath the in-toto project.
JUDGE enables a unified developer and cybersecurity governance experience to mitigate the risk of software supply chain attacks by integrating zero trust principles of observability and verification into software build pipelines. In AWS Marketplace, organizations will have access to the following security tools and capabilities in a configurable package:
  • Build pipeline observer - automates the collection of trusted telemetry across input, environment, action, and output to cryptographically verify supply chain metadata (telemetry) via signing that data with a self-managed key, a key from a Key Management Service (KMS), or an identity.
  • Certificate Authority (CA) - enable an identity-based signature by authenticating and generating a short-lived key, using a TestifySec supported private instance of Fulcio, to create a short-lived certificate (only valid for 10 minutes) that then uses that certificate and key to sign the data, thereby removing the entire burden of key management, key rotation, etc.
  • Time Stamping Authority (TSA) - provide cryptographic proof that your data was signed while the certificate was valid and verify provenance without relying on an external service, enabling artifact verification across disconnected (air-gapped) environments
  • GraphQL data store - ability to manage storage, retrieval, and retention of software build pipeline attestations and trusted telemetry via a GraphQL API to facilitate either ad hoc or deploy-time compliance verification from developer commit to production deployment.
To learn more about JUDGE and how it can secure your software supply chain, visit TestifySec's AWS Marketplace Listing or the JUDGE product page on our website.

Get In Touch

If you find this intriguing and are at the RSA Conference in San Francisco, I'd love to discuss further. Reach out via email at info@testifysec.com, or contact the TestifySec team through our website at https://testifysec.com/contact.