CVE Overload: Scaling Container Vulnerability Scans
summary
Gets specific: a risk formula that combines CVSS EPSS and KEV reclassifies most highs into moderate and cuts critical counts after August, while automation handles assignment and validation via auto-assignment and no-touch ticket closure. Inventory and policy work scale fixes across shared base images and move teams toward distroless base images and shared images. Environment size is real: 5 clusters 200 teams 1,400 namespaces >2,000 images ~34,000 containers and ticket volume remains large.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:26Container scan challenges
- 9:17Ticketing and prioritization issues
- 14:00Vulnerability management strategies
- 22:49Triage and remediation workflows
- 33:11Data insights and stakeholder views
- 36:04Base images and prioritization
- 37:31Results and challenges
- 41:48Lessons learned and improvements
- 43:36Q&A
related talks
25mMy Container Image has 500 Vulnerabilities, Now What?
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
35mEstablishing Container Trust at Scale [I]
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
34mContainer Vulnerability Management in Kubernetes
34mWhat We Learned Dissecting the World's Most Popular Containers
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..