Scan, Patch, VEX - Using Open Source Tools to Manage...
summary
Starts with a 1,500-vulnerability base image that yields 165 high+critical findings, then applies OpenVEX via vctl and registry attachment to drop that to 160, adds a Rego ignore policy in Trivy to reach 114, then uses Trivy’s --ignore-unfixed to get to 21 base OS vulns and two app-level issues. Copacetic automatically rebuilds a patched image that removes the remaining OS CVEs; the two application dependencies still require manual upgrades.
AI-written summary · about
chapters (11)
- 0:00Managing vulnerability noise
- 2:59Introduction to Vex
- 9:07Implementing open Vex
- 15:38Applying upstream Vex
- 19:05Custom exception policies
- 22:01Advanced filtering techniques
- 26:14Automated patching with Copa
- 26:56Running the patch workflow
- 29:07Finalizing the security view
- 30:29Lessons and best practices
- 31:19Q&A and closing discussion
related talks
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
21mDevSecOops: 15 years of DevOps and patching is still horrible
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
19mScanning for known vulnerabilities in an embedded distribution
34mUnpacking Open Source Security in Public Repos & Registries
29mContainer vuln management with (hopefully) minimal...