Informing Cloud Native Vulnerability Management: Some Views from the Past
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 16:00· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Argues for auditability and openness: use grype and trivy so results can be inspected and differences explained; treat appliances and SaaS as black boxes that hide real risk unless vendors disclose packages and versions; stop equating no CVE equals no problem—Kubernetes 2019 audit surfaces high-risk issues without CVEs; expect operations to have limited time and people, so prioritize scalable automation over per-vulnerability manual triage and provide lightweight paths for teams that can’t do deep analysis.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:55Disclaimer
- 1:10My History
- 2:23Lessons from the Past
- 3:09Openness
- 6:50Tyranny of the CV
- 10:06Not everyone is interested
- 12:14Conclusion
related talks
25mThe State of Vulnerability in Cloud Native Security
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
27mEffective Vulnerability Management for a DevSecOps Pipeline
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
21mMake threats visible in your cloud environment — Eric Jung
34mIntegrating Cloud Native Security into the SRE culture
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security