Evolving Secure Development through FedRAMP Continuous Monitoring Trends
summary
Red Hat analyzes FedRAMP continuous monitoring from Jan 2023–Jan 2025 and finds 1,500 CVEs across 220 components (excluding 673 kernel issues), scope triples and average image vulns jump from 20–30 to 70–80 with spikes of 300–400; 53% hit programming languages, 30% CLI tools, 10% libraries, 5.9% OpenSSL, many CWE memory issues. Team uses Quay + CLA scanner health indexes, proposes Conflux secure pipelines, enforces SDLC changes, publishes contextual CVE statements, extends support lifecycles and adds automation and training to reduce poor-image deliveries.
AI-written summary · about
chapters (19)
- 0:00FedRAMP and continuous monitoring
- 1:49What FedRAMP and CM are
- 3:15FedRAMP authorization process
- 5:23CM challenges and tasks
- 6:47Scans and vulnerability management in FedRAMP
- 7:28Issues in continuous monitoring
- 9:38Image health problems and fixes
- 12:07Vulnerability trends analysis
- 13:11Top affected components in FedRAMP
- 14:58Top CWEs and security impact
- 17:28FedRAMP impact on Red Hat
- 20:16Red Hat ripple effects from FedRAMP
- 20:59Blocking poor images
- 22:42Enforcing secure development
- 24:28Improving testing and resources
- 25:10Training gaps in security
- 25:53Accountability in security
- 26:15Next steps for FedRAMP
- 28:23Q&A on FedRAMP challenges
related talks
21mDevSecOops: 15 years of DevOps and patching is still horrible
40mEmbracing Security - A Changing DevOps Landscape
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)