Detection of vulnerabilities and misconfigurations in production images
summary
Built a cluster image scanner that pulls deployed images from multiple Kubernetes clusters across AWS Azure and GCP and scans them with dependency-check/dependency-track, SWID/CycloneDX SBOMs and custom checks. It reports image lifetime check and base image lifetime (found images and base layers from 2017), detects running-as-root and bundled shells, runs malware heuristics, uploads findings to DefectDojo, notifies teams via Slack, and uses Argo Workflows and collectors that produce image lists from git or S3 so operators know what’s actually running in production.
AI-written summary · about
chapters (14)
- 0:00Introduction to image security
- 1:11Who am I and talk overview
- 3:36Typical production cluster challenges
- 6:30Scanning approach and architecture
- 9:15Build pipeline and vulnerability handling
- 11:43Custom image scanner development
- 14:56Image lifetime and distribution checks
- 17:01Malicious content detection
- 18:03Dependency Track for asset inventory
- 21:18Notification and team coordination
- 22:43Motivating teams to act on findings
- 24:32Conclusion and tool summary
- 26:23Live demo of cluster image scanner
- 29:15Q&A session
related talks
34mContainer Vulnerability Management in Kubernetes
51mWhat We've Learned From Scanning 10K+ Kubernetes Clusters
30mA secure journey on Kubernetes
21mMake threats visible in your cloud environment — Eric Jung
38mA Security State of Mind: Compliance and Vulnerability Audits for Containers
33mBuilding Images For The Secure Supply Chain
28mDevSecOps - Security from Scratch
22mIntegrating Security in the Build Pipeline