Full Report
Learn how Wiz for ASPM extends security to developer infrastructure by continuously enforcing secure defaults and detecting threats across the software supply chain.
Analysis Summary
The provided context is a JSON schema describing the structure of an article about **Wiz Code** and securing developer infrastructure. It does not contain specific, named malware families, attack tools (beyond the general tooling provided by Wiz Code itself), or detailed TTPs with MITRE ATT&CK mappings, file hashes, or C2 infrastructure typically associated with malicious artifacts.
Therefore, the summary will focus on the capabilities of the *Wiz Code* platform as described by the schema elements, framing it as a security capability rather than an offensive threat tool.
# Tool/Technique: Wiz Code (Security Platform)
## Overview
Wiz Code is a security solution designed to extend Security Posture Management (SPM) directly into the developer infrastructure and Software Delivery Pipeline (SDLC). Its primary purpose is to identify and remediate risks early in the development lifecycle, securing artifacts and integrating security checks into CI/CD workflows.
## Technical Details
- Type: Security Tool/Framework
- Platform: Developer Infrastructure, CI/CD Systems, Code Repositories, Artifact Registries
- Capabilities: Code scanning, dependency analysis, identity protection monitoring, version control integration, and artifact scanning.
- First Seen: Not specified in the context.
## MITRE ATT&CK Mapping
*(Note: Since Wiz Code is a defensive security tool, direct mappings to adversarial techniques are not applicable in a traditional sense. The tool aims to **prevent** techniques across the execution lifecycle.)*
## Functionality
### Core Capabilities
- **Code Scanning and Dependency Analysis:** Integrates into the developer environment to scan source code and analyze third-party dependencies for vulnerabilities.
- **Version Control Integration:** Works with version control systems (e.g., Git) and CI/CD pipelines to enforce security gates before deployment.
- **Artifact Registry Protection:** Scans and verifies artifacts immediately prior to deployment to ensure integrity.
### Advanced Features
- **Identity Protection and Cloud Detection/Response:** Features dedicated modules focusing on securing developer identities and monitoring for potential cloud-based threats associated with the delivery pipeline.
- **Security Posture Management Extension:** Extends enterprise SPM practices directly into the development environment.
## Indicators of Compromise
*No indicators of compromise are available, as this entry describes a defensive security product.*
## Associated Threat Actors
*Not applicable (Defensive tool).*
## Detection Methods
*Not applicable (Defensive tool).*
## Mitigation Strategies
- Integrating Wiz Code into the SDLC to catch vulnerabilities in code and dependencies early.
- Implementing robust identity protection measures for developer access.
- Enforcing security checks at the artifact registry stage before production deployment.
## Related Tools/Techniques
- SAST (Static Application Security Testing) tools
- SCA (Software Composition Analysis) tools
- Cloud Security Posture Management (CSPM) solutions