A big part of any organization’s risk assessment process is to be aware of and gain visibility into vulnerabilities in the software being used. This page gathers resources about the the importance of container vulnerability scanning including Docker vulnerability scanning and information on various vulnerability scanners.
Table of Contents:
Below we have compiled publicly available sources from around the world that present views on Container Vulnerability Scanning.
Kubernetes Security Operating Kubernetes Clusters and Applications Safely
Container Security Best Practices — When containerization is implemented with good security practices, containers can offer better application security rather than a VM only solution. This page gathers resources about basic tips and best practices as to how to secure containers.
Containers for DevSecOps — DevSecOps is an extension of the DevOps concept that emphasizes the integration of security teams into continuous delivery workflows. This page gathers resources about how DevSecOps makes for a more efficient and secure containers.
Container Vulnerabilities and Threats — While containers are driving evolution in the management of network applications, which, although self-contained, are still vulnerable. This page gathers resources about container vulnerabilities like 'Dirty Cow' and 'Escape Vulnerability' including tips on how to secure containers from cyber threats.
Container Vulnerability Scanning — A big part of any organization’s risk assessment process is to be aware of and gain visibility into vulnerabilities in the software being used. This page gathers resources about the the importance of container vulnerability scanning including Docker vulnerability scanning and information on various vulnerability scanners.
Container Secrets Management — In computing as in real life, a secret is information you want kept private, outside of the people and systems you want or need to share it with. In the application security realm, common examples of secrets are passwords, tokens, and private keys. This page gathers resources about managing secrets in containers including Docker containers, Amazon Elastic Container Service, Kubernetes and more.
Container Access Control — The wide adoption of containers and the ability to retrieve images from different sources impose strict security constraints. Containers leverage Linux kernel security facilities, such as namespaces, cgroups and Mandatory Access Control. This page gathers resources about container access control - deciding and enforcing who gets access to which container resources.
Container Audits and Compliance — Security and compliance are top of mind for IT organizations. In a technology-first era rife with cyber threats, it is important for enterprises to have the ability to deploy applications on a platform that adheres to stringent security baselines. This page gathers resources about audits and compliance of containers and their relationship to security.
The Shift Left Principle and DevOps — The move to Agile and DevSecOps development processes has fostered a lot of attention on the need to shift security testing left in the development cycle. Moving security testing into the realm of the developer makes security testing faster, easier, more effective and less expensive. The page gathers resources about how shifting left improves DevOps and security.