Timeline for CIS Benchmark for Docker and Docker Bench for Security: why, how and when?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 4, 2019 at 22:14 | comment | added | simbo1905 | Today I was on a call about dev teams being swamped by security scanning reports and then effectively ignoring them when they see a number of false positives or things that are out of their control. This reinforces to me that information isn’t knowledge. I was lucky enough to work with one of the authors of a book amazon.co.uk/Agile-Application-Security-Laura-Bell/dp/… that has a lot of advice that aligns to devops. Well worth a read to understand where security tools fit in with devops behaviours. | |
| Feb 4, 2019 at 17:06 | comment | added | Sylvain Leroux | I finally chose to ask another question specifically focusing on the "educational" aspects since the current question has already obtained two very good answers. | |
| Feb 4, 2019 at 16:36 | comment | added | Sylvain Leroux | Thanks, Brandon. As always, that's an enlightening answer, and I think I got the point in following the CIS recommendations to harden the actual production environment. But I also had educational aspects in mind while asking this question. From what you said, Docker Bench is not necessarily the best tool to raise new users awareness about the risks associated with running Docker without any safety precautions. Maybe would you have something else to suggest that would better suit that need? | |
| Feb 4, 2019 at 13:18 | history | answered | BMitch | CC BY-SA 4.0 |