Keynote: We’re VEXing the Cloud Native Landscape. Bring Your Code!
summary
A practical report on bootstrapping VEX into cloud native workflows: a lightweight OpenVEX feeds format, two spec revisions after testing with three major scanners, and a first set of tooling that automates VEX issuance and consumption. Community work through the Cloud Native Security Slam yields 11 maintainers, 20 contributors, 6 projects creating feeds, and demos show scanners using VEX to suppress false positives and mark triage state so consumers get actionable results.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03Securing open source challenges
- 2:30What is VEX and how it works
- 4:59OpenVEX project goals
- 6:02Bootstrapping VEX ecosystem
- 7:26Cloud Native Security Slam
- 9:15Completing VEX ecosystem loop
- 10:20Ecosystem growth and impact
- 11:47Conclusion
related talks
27mWeaving a VEX Feed Through the Kubernetes Project
26mWeaving a VEX Feed Through the Kubernetes Project
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
01h 00mPanel Discussion: Don’t be Vexed by VEX - VEXperts Panel
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
45mVEXing Open Source Security: Vulnerability Data for Everything
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems