Watching the Watchers: The Hidden Risks of Container Scanning Tools

on YouTube ↗29m

" summary

Vulnerability scanners themselves often contain exploitable bugs, require elevated privileges, and produce false positives and false negatives; a concrete example is Clair’s 2019 dependency flaw in a Go HTTP library. Recommendations include pipeline integration with GitLab, continuous DB updates and CVE feeds, runtime plus static scans (Trivy, Clair, Snyk, Aqua), admission control with OPA or Kyverno, enforce distroless images, avoid running containers as root, use secrets managers (Vault/AWS Secrets Manager), and apply AppArmor/SELinux and seccomp for isolation.

AI-written summary · about

" chapters (9)

1. 0:00Container scanning risks
2. 2:29Vulnerability scanners confusion
3. 4:17Container scanning in DevSecOps
4. 10:16Scanner features to prioritize
5. 15:53False positives and negatives
6. 19:49Minimal images for scanning
7. 21:14Defense in depth for security
8. 25:48Essential scanner requirements
9. 27:36Closing and resources

" related talks

• 30mMaster the Container Security Model withGuillermo Palacio Oto · DockerCon 2022
• 32mA Security State Of Mind: Compliance and ...Chris Van Tuin · DevOpsDays Seattle 2017
• 24mSecuring Container WorkloadsVineeth Pothulapati · Kubernetes Forum Delhi 2020
• 37mA question of trust: When good containers go badTim Mackey · DevOpsCon 2017 Berlin
• 50mRuntime Security for ContainersSpencer Krum · Devnexus 2020
• 24mOvercoming CVE Shock - Adding Perspective in Vulnerability ScanningBen Hirschberg · SREday London 2022
• 18mContinuous Security - Building Security into your PipelinesMatt Jarvis · Conf42 Cloud Native 2021
• 21mWhat is the Best Container Security Workflow for Your Organization?Fani Bahar, Hadar Mutai · DockerCon 2022