UBCIS: Ultimate Benchmark for Container Image Scanning
Talkat 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20) · on Monday, 2020-08-10·
summary
Claims a repeatable benchmark called UBCIS and an open-source framework that runs multiple container-image scanners against five base distributions (Debian, Ubuntu, Alpine, Fedora, CentOS). Finds that no scanner reports the full superset of known vulnerabilities and reports large inconsistencies; manual labeling yields 98 Debian, 72 Ubuntu and 10 Alpine judged cases and many Fedora entries left unjudged. Provides relaxed vs paranoid scoring modes, documents common false positives (kernel, empty packages, arch mismatch) and recommends combining scanners and choosing mode by risk tolerance.
AI-written summary · about
chapters (4)
- 0:00Start
- 0:09UBCIS Ultimate Benchmark for Container Image Scanning
- 5:41Applicability Classes
- 10:38Before Choosing Scanner
related talks
29m5 Security Best Practices For Production Ready Containers
30mMaster the Container Security Model with
34mUnpacking Open Source Security in Public Repos & Registries
16mUnpacking Open Source Security in Public Repos
35mSecuring Containers by Breaking In
30mWhat We Learned Dissecting the World’s Most Popular Containers
57mBreaking and Fixing your ‘Docker’ ized environments
35mDocker Security