Skip to main content

Enable Customer Access to Security Information

note

The Security Center is Beta. The features and functionality described on this page are subject to change.

The Security Center allows you to provide security information to customers through Enterprise Portal (Classic) or Enterprise Portal (New). The configuration steps and customer experience differ between the two portals.

Enterprise Portal (Classic)​

The Security Center tab in Enterprise Portal (Classic) displays security information for each available release version. Customers can:

  • View a CVE report with the complete list of known vulnerabilities and their severity levels
  • View details about the vulnerabilities identified for each image
  • Understand how many CVEs are fixed by upgrading to newer versions
  • Download the Software Bill of Materials (SBOM) in SPDX format for compliance and security audits

The following shows an example of the Security Center dashboard in Enterprise Portal (Classic):

Enterprise Portal (Classic) Security Center dashboard

View a larger version of this image

Enable the Security Center in Enterprise Portal (Classic)​

The Security Center tab is not enabled by default. If the Security Center feature flag is enabled for your team, you can enable the tab for one customer or all customers.

To enable the Security Center tab for one customer:

  1. In the Vendor Portal, go to Customers > [Customer] > Enterprise Portal access.
  2. Enable Enable Security Center for this customer.

To enable the Security Center tab for all customers using Enterprise Portal (Classic):

  1. In the Vendor Portal, go to Enterprise Portal > Portal Settings.
  2. Under Optional Features, enable Enable Security Center.

Enterprise Portal (New) (Alpha)​

In Enterprise Portal (New), you add a Security page to your content repository. The page can include a release selector, CVE report, and SBOM report. For more information, see Security components in Customize Enterprise Portal Content.

Customers can select a release and review CVEs by severity, affected component, and container image. The CVE report identifies the earliest vendor release that resolves each CVE. Customers can also compare the selected release with the latest release, follow links to upgrade affected instances, and download an SBOM. When enabled in the Portal Features settings, customers can also download the raw Grype scan JSON for a release.

Security reports, including raw scan downloads, are available for Helm and Embedded Cluster releases for both online and air gap installations. Customers whose licenses support only KOTS or kURL see a message that security reports are not available.

Configure Security Center display settings​

To configure how Security Center reports display in Enterprise Portal (New):

  1. In the Vendor Portal, go to Enterprise Portal > Content.
  2. Under Portal Features, configure Display only fixable CVEs in Security Center report:
    • When enabled, customers see only CVEs with an available fix.
    • When disabled, customers can switch between all CVEs and CVEs with an available fix.
  3. Configure Enable raw CVE scan to be downloadable. This setting is disabled by default:
    • When enabled, the CVE Report card displays Download full CVE report. Customers can use this button to download the complete raw Grype scan JSON for the selected release.
    • When disabled, the button is not displayed. Customers can still view the CVE report when they have access to the Security Center.

Changes to the Portal Features settings are saved automatically.

The downloaded JSON contains the same raw Grype scan data that is available to vendors through the securebuild/scan-raw Vendor API endpoint. The customer-facing download is controlled by this setting and is distinct from both Vendor API access and the SPDX SBOM download.

Enable Security Center for a customer​

The Portal Features settings control how Security Center reports display; they do not grant Security Center access to individual customers. To grant access:

  1. In the Vendor Portal, go to Customers > [Customer] > Enterprise Portal access.
  2. If Portal Version is available, set it to Use new Enterprise Portal for this customer.
  3. Enable Enable Security Center for this customer.

Add a Security page to the content repository​

Add a page containing the Security Center components to each applicable version branch in your content repository. Include the page in toc.yaml so that customers can open it from the portal navigation. For more information, see Table of contents in Customize Enterprise Portal Content.

On this page