First Steps to Full Lifecycle Security with Open Source Tools

on YouTube ↗01h 21m

" summary

Hands-on demos use Trivy to scan container images, GitHub repos, Dockerfiles, Kubernetes manifests and Terraform, showing JSON output, jq filtering for a CVE and ignore-unfixed dropping results (example 19→4). Trivy also emits SBOMs (CycloneDX/SPDX) and a Docker Desktop extension. An operator installs Starboard into a cluster, auto-creates vulnerability and config-audit CRs, and rescans after fixes (uncommenting USER, setting privileged=false) to clear alerts; GitHub Actions + SARIF upload is shown too.

AI-written summary · about

" chapters (38)

1. 0:00Start
2. 2:49Things You Will Need
3. 3:41Ground Rules
4. 4:42Commands File
5. 5:19Installing Trivia
6. 8:37Using Security Scanners
7. 9:20Vulnerability Scanning
8. 9:37Vulnerability Scanner
9. 10:26How Do Vulnerability Scanners Work
10. 11:23Programming Language Package Scanning
11. 12:09Open Source Vulnerability Scanners
12. 18:14Types of Vulnerability Scanning
13. 19:22Secret Scanning
14. 24:21Git Clone
15. 24:53Scan Private Git Repositories
16. 28:05Cvss Score
17. 29:47Parsing the Output of Json
18. 32:02Configuration Scanning
19. 34:51Cis Benchmarks
20. 36:47Configuration Scan
21. 42:22Edit the File
22. 44:38Fix a Docker Issue
23. 57:41Security Scanning
24. 57:58Linting Tools
25. 59:01Security Icd
26. 59:19Github Actions
27. 1:00:01Vulnerability Scanning in Github Actions
28. 1:01:35Uploading It to Github Security
29. 1:04:25Install Starboard
30. 1:07:11Create a Vulnerability Scan
31. 1:07:53Vulnerability Report
32. 1:08:23Integrations
33. 1:08:43Cluster Scoped Vulnerability Reports
34. 1:09:14Configuration Audit Scans
35. 1:10:47Infrastructure Scans
36. 1:13:22Cluster Compliance Reports
37. 1:15:20Alternative for Nsa Reports
38. 1:16:13Custom Policies

" related talks

• 32mClimbing high — getting started with cloud native security through open sourceAnais Urlichs · stackconf 2023
• 24mSecuring Container WorkloadsVineeth Pothulapati · Kubernetes Forum Delhi 2020
• 39m5 Open Source Security Tools All Developers Should Know AboutRan Regenstreif · CloudOpen @ Open Source Summit North America 2022
• 34mIntegrating Cloud Native Security into the SRE cultureAnais Urlichs · Conf42 DevSecOps 2022
• 35mFrom Builds & CI to Security Testing in a Single PRSarah Khalife · Open Source in Finance Forum New York 2022
• 16mContinuous CVE Scanning with Trivy OperatorVitaliy Schreibmann · ContainerDays Conference 2024
• 36mContainer Security Made Easy – Tools and Techniques for DevelopersNico Meisenzahl, Philip Welz · ContainerDays Conference 2024
• 32mBuilding a Secure By-Design Pipeline with an Open Source StackRotem Refael · CloudOpen @ OSS LATAM 2022