It's Not a Best Practice If No One Can Follow It: Learning From...
summary
History of Twistlock-style defenses—vulnerability scanning, runtime protection, container-level microsegmentation—and why teams still flail on policy and adoption. Concrete comparisons: official engineX: ~70 MB, ~230 packages, ~100+ vulnerabilities versus Minimus engineX: 9 MB, 15 packages, zero CVEs, and practical CI gates like Trivy/Grype plus admission controllers. Shows how distroless/droist images, maintained metadata feeds, and hardened runtimes reduce attack surface and enable real-time containment, but warns that deployability and long-term maintenance remain the main blockers.
AI-written summary · about
chapters (8)
- 0:00Container security history
- 5:18Early container security challenges
- 9:32Current security pain points
- 11:41Containers not a security boundary
- 13:04Detection to prevention shift
- 16:15Security and developer collaboration
- 17:38Q&A on container security
- 26:44Unsolved cloud-native challenges
related talks
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
38mSo. Many. Vulnerabilities. Why are containers such a mess...
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
32mSponsored Session: A New Security Standard for the AI Era: Zero-CVE and Real-Time Threat…
28mCode, Dependencies and Security: Where Is the Risk
32mEmbedded Linux Security: Dr Jekyll and Mr Hyde
41mIdentifying and Mitigating Cloud and Container Threats
06mLightning Talk: Security Down to the Kernel