Container vuln management with (hopefully) minimal...
summary
Lyft scans 1000+ service images, builds an image-lineage graph with cartography, and uses trivy feeds to convert findings into exact fix versions; an MVP launches in six weeks but initial automation mis-closes tickets and burns out volunteers. A state machine plus circuit-breakers and dashboards prevent runaway closures, infra auto-PRs propagate base-image fixes, and a dedicated 3–5 person vulnerability team sustains the program. Result: actionable, automated remediation that prioritizes fixable inherited vs service-introduced vulns and finally works.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 2:54Container vuln management journey
- 6:07Scaling scans and image lineage
- 10:45Actionability and graph approach
- 13:56MVP failure and lessons learned
- 17:28Automation and state management fixes
- 21:19Staffing and dedicated team
- 24:28Key takeaways and improvements
- 27:22Q&A and closing
related talks
44mVulnerability Management that developers won't hate
34mContainer Vulnerability Management in Kubernetes
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
42mScan, Patch, VEX - Using Open Source Tools to Manage...
56mTaming Vulnerability Remediation at a Fortune 50 Company
51mPractical Approach to Automate the Discovery & Eradication of Open-Source Software Vulnerabilities
35mKeynote: How I learned to stop worrying and love CVEs- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage