Your organization recently adopted a container-based workflow for application development.
Your team develops numerous applications that are deployed continuously through an automated build pipeline to the production environment.
A recent security audit alerted your team that the code pushed to production could contain vulnerabilities and that the existing tooling around virtual machine (VM) vulnerabilities no longer applies to the containerized environment.
You need to ensure the security and patch level of all code running through the pipeline.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
The organization has adopted a container-based workflow for application development and deploys numerous applications through an automated build pipeline to the production environment. A recent security audit has alerted the team that code pushed to production could contain vulnerabilities and the existing tooling around VM vulnerabilities is no longer applicable in the containerized environment. Therefore, the team needs to ensure the security and patch level of all code running through the pipeline.
Option A: Set up Container Analysis to scan and report Common Vulnerabilities and Exposures. Container Analysis is a tool that scans container images and reports any Common Vulnerabilities and Exposures (CVEs) found within them. By setting up Container Analysis in the build pipeline, the team can scan all container images and identify any security issues. This option is a recommended solution to ensure the security of container images and is an effective way to detect security issues early in the development process. It is a good practice to use Container Analysis to scan all container images to ensure the images are secure and free from any known vulnerabilities.
Option B: Configure the containers in the build pipeline to always update themselves before release. This option suggests configuring containers in the build pipeline to automatically update themselves before release. While automatic updates can help keep containers up-to-date with the latest security patches, it can also introduce potential issues. If an update causes compatibility issues or conflicts with other dependencies, it may result in downtime, which could impact the production environment. Additionally, automatic updates could also introduce new vulnerabilities if the updates are not tested thoroughly before release. Hence, this option may not be the best solution to ensure the security and patch level of all code running through the pipeline.
Option C: Reconfigure the existing operating system vulnerability software to exist inside the container. This option suggests reconfiguring the existing operating system vulnerability software to exist inside the container. However, since containers are designed to be lightweight and portable, it is not recommended to install additional software within them, as it may increase their size and complexity. It is also important to note that containers have their own operating system, which may differ from the host operating system. Therefore, installing vulnerability software may not be feasible in this case. This option may not be the best solution to ensure the security and patch level of all code running through the pipeline.
Option D: Implement static code analysis tooling against the Docker files used to create the containers. This option suggests implementing static code analysis tooling against the Docker files used to create the containers. Static code analysis tools scan code for known vulnerabilities and coding issues. By implementing this option, the team can detect any security issues within the Dockerfiles used to create the container images. This can help identify potential security risks early in the development process. However, this option does not address security risks introduced by third-party libraries or dependencies used within the container images. Hence, it may not be the most effective solution to ensure the security and patch level of all code running through the pipeline.
Conclusion: Option A is the most appropriate solution to ensure the security and patch level of all code running through the pipeline. By setting up Container Analysis in the build pipeline, the team can scan all container images and identify any security issues. This option is an effective way to detect security issues early in the development process, and it is a good practice to use Container Analysis to scan all container images to ensure they are secure and free from any known vulnerabilities.