Open Source Summit North America 2017

Containerization has increased the pace of application deployment, but has trust kept pace? Once an image is compromised, which applications are at risk and how far has trust been broken?
To answer this, we assert the container image came from a trusted source, and that our application was subject to static code analysis and the container to pen-testing. We further assert appropriate perimeter defenses and deployment controls are in place. While we have defined a trust model, we didn’t include the impact of information flow.
Vulnerability remediation is a function of awareness. To devise an action plan, defenders must assess the impact of a security issue. Malicious actors with early access to information can craft and refine attacks while defenders are reacting. Having a full inventory of container dependencies is key to increasing awareness and reducing reaction time from days to hours.