1. 1
Tackling the
Container Iceberg:
How to approach security when most of
your software comes from the community

2. 2
THE CONTAINER LIFECYCLE
Build RunShip

3. 3
THE CONTAINER IMAGES LAYERS

4. 4
LET’S START WITH THE OBVIOUS QUESTIONS
▪ Do you use a private registry?
▪ When using a public registry, are the
images signed?
▪ Are you running the containers with a
root user?

5. 5
WHAT ABOUT THE
REAL BLIND SPOTS OF
USING CONTAINERS?

6. THE CHALLENGES OF OPEN SOURCE USAGE
Reported Vulnerabilities
Are Rising
Less Time To Fix

7. 7
SECURITY SHOULD BE A BIG CONSIDERATION

8. 8
WHAT CAN HELP YOU GAIN VISIBILITY?

9. 9
INFUSING SECURITY INTO THE SDLC IS VITAL

10. 10
THE QUESTION IS, HOW SOON IN THE SDLC?
PLAN CODE BUILD MAINT.DEPLOY

11. 11
THE EARLIER, THE CHEAPER AND EASIER TO FIX
Coding
$80/Defect
Build
$240/Defect
QA & Security
$960/Defect
Production
$7,600/Defect
The cost of fixing security and quality issues is rising significantly, as the development cycle advances.

12. 12
66% of companies have already implemented application testing during or even pre-build stage.
In what stage of the SDLC do you spend most of your time implementing security measures?
HOW ARE OTHER COMPANIES HANDLING IT?

13. CODEFRESH SLIDES TO ADD???

15. Thank You!
15