Securing Vulnerabilities in Docker Images

Efe, Ahmet; Aslan, Ulaş; Kara, Aytekin Mutlu

doi:10.46460/ijiea.617181

Cited by 5 publications

(3 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The survey results extend the knowledge from industry to literature, adding details about the testing methods used. Moreover, the survey results confirm the common use of tools, diverse needs and corresponding methods and tools [1,7,16], concerns about security and vulnerabilities [4,5,3,17], the importance of automation and CI/CD implementations and dynamic program analysis [16], and the need for further knowledge and research [6].…”

Section: Discussionmentioning

confidence: 55%

See 1 more Smart Citation

Anomaly Detection Through Container Testing: A Survey of Company Practices

Timonen,

Sroor,

Mohanani

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Background: Containers are a commonly used solution for deploying software applications. Therefore, container functionality and security is a concern of practitioners and researchers. Testing is essential to ensure the quality of the container environment component and the software product and plays a crucial role in using containers. Objective: In light of the increasing role of software containers and the lack of research on testing them, we study container testing practices. In this paper, we investigate the current approaches for testing containers. Moreover, we aim to identify areas for improvement and emphasize the importance of testing in securing the container environment and the final software product. Method: We conducted a survey to collect primary data from companies implementing container testing practices and the commonly used tools in container testing. There were 14 respondents from a total of 10 different companies with experience using containers and varying work responsibilities. Findings: The survey findings illustrate the significance of testing, the growing interest in and utilization of containers, and the emerging security and vulnerability concerns. The research reveals variations in testing approaches between companies and the lack of consensus on how testing should be carried out, with advancements primarily driven by industry practices rather than academic research. Conclusion: In this study, we show the importance of testing software containers. It lays out the current testing approaches, challenges, and the need for standardized container testing practices. We also provide recommendations on how to develop these practices further.

show abstract

Section: Discussionmentioning

confidence: 55%

“…Another article from 2021 [16] investigates the accuracy of container scanning tools and highlights the vulnerability of the container's operating system. Additional mitigation strategies involve implementing strong access controls and ensuring containers remain lightweight [17].…”

Section: Container Testing Approachesmentioning

confidence: 99%

Anomaly Detection Through Container Testing: A Survey of Company Practices

Timonen,

Sroor,

Mohanani

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Adanya container pada Docker memberikan banyak kemudahan, akan tetapi perlu diperhatikan mengenai keamanan, kerentanan dan risiko dari penggunaannya. Seiring berjalannya waktu, laju pertumbuhan pada teknologi Docker meningkat sangat pesat [3]. Peningkatan pesat ini terjadi antara tahun 2015 sampai 2017.…”

Section: Pendahuluanunclassified

Vulnerability Management Pada Vulnerable Docker Menggunakan Clair Scanner Dan Joomscan Berdasarkan Standar GSA CIO-IT Security-17-80

Ramadhan

Widjajarto²,

Almaarif³

2022

json

View full text Add to dashboard Cite

Vulnerabilities in Docker need to be managed considering that this vulnerability is one of the potentials for exploitation, this can happen because Docker is a container related to application and system security. This study analyzes the vulnerability management process in Docker Images and Docker Images Applications using the GSA CIO-IT Security-17-80 standard. This vulnerability search uses two scanning tools, namely Clair Scanner and JoomScan. Vulnerabilities in Docker Images and Docker Images application version - 1, were overcome by creating a new system, namely version - 2 which upgrades the Docker Images software and Docker Images application. The test scenario is run by scanning for vulnerabilities in two versions of the trial system, in the form of a vulnerability report. The data was analyzed using the GSA CIO-IT Security Standard-17-80 which was limited to the stages of Scanning Capabilities, Vulnerability Scanning Process, Vulnerability Scan Reports, Remediation Verification, and Re-Classification of Known Vulnerabilities. The result is the fastest scanning time is in version - 2, the results of the comparison of vulnerabilities obtained are 44.45% on Docker Images and 77.78% on Joomla. So that the contribution that can be given is to provide an overview of the use of the GSA CIO-IT Security-17-80 standard as a guide for managing the security of an IT asset based on the stages carried out. Continuation of research can be in the form of using the 6 stages of GSA with the support of adequate vulnerability data from the right scanner software.

show abstract

An Empirical Investigation of Docker Sockets for Privilege Escalation and Defensive Strategies

Mathi,

et al. 2024

Procedia Computer Science

View full text Add to dashboard Cite

Securing Vulnerabilities in Docker Images

Cited by 5 publications

References 12 publications

Anomaly Detection Through Container Testing: A Survey of Company Practices

Anomaly Detection Through Container Testing: A Survey of Company Practices

Vulnerability Management Pada Vulnerable Docker Menggunakan Clair Scanner Dan Joomscan Berdasarkan Standar GSA CIO-IT Security-17-80

An Empirical Investigation of Docker Sockets for Privilege Escalation and Defensive Strategies

Contact Info

Product

Resources

About