Vulnerability Management for Containers by Scott Wilson
Examines vulnerability Management for Containers by Scott Wilson and evaluates key implications for security practitioners.
Summary
Talk Scope and Goals
Scott Wilson of IBM X-Force Red frames container vulnerability management for CarolinaCon Online. He distinguishes scanning from broader container hardening, orchestration deep dives, and vendor sales pitches.
Containers vs VMs and the 4Cs
Containers are portable, layered runtimes sharing a host OS, unlike VMs that duplicate full guest operating systems. He walks through images, runtime engines like Docker, and the cloud-cluster-container-code security model that expands attack surface when poorly managed.
CI/CD, Scanning, and Tooling
The talk covers how container adoption changes vulnerability management versus twenty years of host scanning. Wilson outlines development pipeline risks, scanning strategies, marketplace tool tradeoffs, Kubernetes admission controllers, and compliance considerations for container fleets.
Takeaways
Attendees should leave able to discuss how to scan, prioritize, and govern container vulnerabilities with development and security teams.
Related talks
CODE BLUE·40 min
Industry experts analyze emerging threats surrounding [CB22]Sisyphus and the CVE Feed: Vulnerability Management at Scale.
FIRST·24 min
Engineers explore architecture and security mechanisms for Lessons from OSV: Vulnerability Management for Open Source.
OWASP Foundation·39 min
Engineers explore architecture and security mechanisms for AppSecCali 2019 - The Art of Vulnerability Management.