A question of trust: When good containers go bad
summary
Claim: containers that pass initial checks become unsafe as external vulnerabilities evolve, exemplified by CVE-2016-5195 (dirty cow) and the Apache Struts flaw behind Equifax, where identification averages six months and Equifax took 144 days to detect. Practical tools discussed include scanning registries (Docker Hub, Red Hat catalog), OpenSCAP and Kubernetes/OpenShift integration; Black Duck built an Off-site OpenShift connector that annotates images, blocks noncompliant deploys and updates vulnerability annotations within about 1–1.5 hours.
AI-written summary · about
chapters (11)
- 0:00Introduction and context
- 1:45The impact of data breaches
- 4:41Container security paradigm
- 7:43Risks of open-source software
- 11:09Anatomy of a vulnerability
- 14:40Lifecycle of security flaws
- 17:44Tools for security analysis
- 21:13Case study: Equifax breach
- 25:32Automation in security
- 28:36Continuous monitoring strategy
- 31:04Automating policy compliance
related talks
32mA Security State Of Mind: Compliance and ...
35mEstablishing Container Trust at Scale [I]
37mIt’s 2018; Are My Containers Secure Yet?!
29mWatching the Watchers: The Hidden Risks of Container Scanning Tools
27mRethinking Compliance in a Containerised World
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
38mA Security State of Mind: Compliance and Vulnerability Audits for Containers