Security Scanning - Past/Present/Future
summary
Explains how CVE/CVRF/OVAL metadata actually maps to checking systems, using OVAL definitions and the OpenSCAP scanner against RHEL7 container images (podman offline scan) and referencing tools like Clair and quay.io. Demonstrates a live scan that finds missing advisories and an unpatched libssh vulnerability, exposes fragile file-selection logic and the need to pick correct OVAL files, and counts CVE authority participants at 153 orgs in 25 countries. Argues for adding container/runtime tests and better repo-to-CPE matching.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:50Security Metadata
- 3:40Security Advisory
- 10:34CVR Limitations
- 11:35Oval
- 15:21Demo
- 16:07Red Hat
- 17:45Results
- 20:51Building Blocks
- 21:25Metadata
- 22:32Criteria
- 23:31Example
- 24:45More checks
- 25:49Second test
- 29:37Limitations
- 32:01Whats next
- 33:43Questions
related talks
38mA Security State of Mind: Compliance and Vulnerability Audits for Containers
32mA Security State Of Mind: Compliance and ...
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
34mUnpacking Open Source Security in Public Repos & Registries
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
29mWatching the Watchers: The Hidden Risks of Container Scanning Tools
50mScaling Security Assessment at the Speed of DevOps
42mNavigating the Sea of CVEs: Securing Your Linux Distributions