"Many organizations are using containers to develop and manage their applications. Containers enable development teams work faster, deploy more easily and efficiently, and operate at a much larger scale. However, there are many security measures that need to be taken across the entire software development lifecycle, especially when it comes to open source security. In this session, Shiri Ivtsan, Product Manager at WhiteSource, will discuss: 1) The complexity and security challenges with containers 2) The greatest risks when deploying containers 3) The three steps to take before shipping a Docker container 4) How to automate your container security process"

1. Deep Dive into
Container Security
Shiri Ivtsan, Product Manager

2. Monolith to Microservice and Container

3. Container Lifecycle
Build RunShip

4. Open Source
96.8%
Of the developers rely on
Open Source components

5. Number of Reported Open Source
Vulnerabilities GREW by 51.2% in 2017
https://www.whitesourcesoftware.com/open-source-vulnerability-management-report

6. Open Source Challenges
https://www.whitesourcesoftware.com/open-source-vulnerability-management-report
1One challenging area in particular
is pronounced
https://www.whitesourcesoftware.com/open-source-vulnerability-management-report

7. The Common Way of Handling
Security Vulnerabilities
Security teams analyze
and prioritize
vulnerabilities
Sending emails or
opening issues/tickets
Closing the loop on
resolution is hard

8. Bridging the Gap is a Must
Security DevOps Developers

9. How to Bake Security Into
Existing Workflows

10. Let’s Start With Some Questions
▪ Do you use a private registry?
▪ When using a public registry, are the images
signed?
▪ Do you regularly scan your images?
▪ How quickly are images rebuilt with security
fixes?

11. CI/CD Gates
Integrate security testing into
your build and CI process DevOps
Build
TestDeploy

12. CI/CD Gates
Use automated policies to
fail builds with issues

13. Security Layers
Scan across the lifecycle:

14. Trusted Sources
Use private registries and sign
images from public registries

15. Step 3: Don’t Use Defaults
Enable Role-Based Access
Control (RBAC) in your
container orchestration

16. Step 3: Don’t Use Defaults
Use Namespaces to Establish
Security Boundaries

17. Manage Deployments
Prevent deployment of images
with known vulnerabilities

18. Manage Deployments
Prevent deployment of
containers that require root

19. Manage Deployments
Validate image signatures

20. Monitor for new vulnerabilities
Manage Deployments

21. Thank You!