Advanced Vulnerability Management in Cloud Foundry - Molly Crowther & Stephen Levine, Pivotal
summary
A vulnerability management system called Davos collects Ubuntu USNs and Black Duck scan results, creates GitHub/Pivotal Tracker issues, and stores fix metadata and product relationships so downstream teams know what to patch. The automated pipeline produces a new rootfs in about two-hour rootfs pipeline from USN ingestion and stemcells can ship within a day for critical kernel flaws. The system also generates public Cloud Foundry security notices and reduces manual coordination via Black Duck integration.
AI-written summary · about
chapters (10)
- 0:00Introduction and speakers
- 1:24What is Davos
- 3:14Heartbleed and Dirty Cow impact
- 5:31Security notices process
- 7:20Challenges in vulnerability management
- 10:13Manual workflow before Davos
- 13:30Automated root FS patching
- 16:40Davos overview and purpose
- 18:27Future of Davos and community
- 20:38Q&A on third-party dependencies
related talks
31mHealthy Agile Product Security
33mVulnerability Management Lifecycle in DevSecOps
30mManaging Vulnerabilities through SSDLC
40mManaging Risk Across the Vulnerability Ecosystem
44mVulnerability Management that developers won't hate
31mStranger Danger: Addressing Vulnerable CF Application Dependencies
37mPlatform and Security Engineering
27mEffective Vulnerability Management for a DevSecOps Pipeline