Lightning Talk: What’s Inside Your Container Image? How to Audit All the Dependencies...
summary
Describes a concrete pipeline that inventories every container image, generates an s-bom in CycloneDX for each image, scans licenses and CVEs with OWASP Dependency-Track policy engine, signs image and SBOM with cosign, and produces a compliance attestation stored in a trusted internal registry. Implemented for Improbable Defence to allow admission controllers to block noncompliant images, reduce incident-response load, and answer “which services contain a given CVE” across environments.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:26Setting the Scene
- 4:40Use only a trusted Image registry
- 6:12Evaluate Image
- 7:52Maintain a Dependency inventory
related talks
35mThe State of Your Supply Chain
27mRethinking Compliance in a Containerised World
46mSCA for Containers: The Good, the Bad, and the Truth
25mA Primer on Software Bill of Materials for DevSecOps
16mTime for a Check-Up of Your CI/CD Pipelines!
48mContainer Security: It’s All About the Supply Chain
18mPractical End-to-End Container Security at Scale
36mContainer Security Made Easy – Tools and Techniques for Developers