Vulnerability assessment of machine images in development phase
In an embodiment, a software object development system generates a pre-release version of a machine image of a software object, and transmits information associated with the pre-release version of the software object to a vulnerability management system. The vulnerability management system performs a vulnerability scan for known vulnerabilities(s) on the information associated with the pre-release version of the machine image of the software object. The vulnerability management system determines scan result(s) based on the vulnerability scan, and transmits, to the software object development system, a report comprising the scan result(s).
1 . A method of operating a vulnerability management system, comprising:
receiving, from a software object development system, inventory information associated with a pre-release version of a machine image of a software object;
performing a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object;
determining one or more scan results based on the vulnerability scan; and
transmitting, to the software object development system, a report comprising the one or more scan results,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
2 . The method of claim 1 , wherein the virtualized environment is Infrastructure as a Service (IaaS).
3 . The method of claim 1 , wherein the virtualized environment is Amazon Web Services (AWS).
4 . The method of claim 1 , the inventory information associated with the pre-release version of the machine image of the software object comprises a set of installed software, configuration information, or a combination thereof.
5 . The method of claim 1 , wherein the determining comprises:
calculating a vulnerability risk score associated with the vulnerability scan.
6 . The method of claim 5 ,
wherein the report indicates whether the vulnerability risk score is below a threshold, or
wherein the report indicates the vulnerability risk score, or
wherein the report indicates whether the pre-release version of the machine image of the software object passes or fails a vulnerability test based on the vulnerability risk score.
7 . A method of operating a software object development system, comprising:
generating a pre-release version of a machine image of a software object;
transmitting, to a vulnerability management system, inventory information associated with the pre-release version of the machine image of the software object; and
receiving, from the vulnerability management system, a report comprising one or more scan results associated with a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
8 . The method of claim 7 , further comprising:
determining whether the pre-release version of the machine image of the software object passes or fails a vulnerability test based on the one or more scan results.
9 . The method of claim 8 , further comprising:
releasing the pre-release version of the machine image of the software object if the pass or fail determination determines that the pre-release version of the machine image of the software object passes the vulnerability test.
10 . The method of claim 8 , wherein the pass or fail determination is based on a vulnerability risk score associated with the pre-release version of the machine image of the software object.
11 . The method of claim 10 ,
wherein the report indicates whether the vulnerability risk score is below a threshold, or
wherein the report indicates the vulnerability risk score, or
wherein the report indicates whether the pre-release version of the machine image of the software object passes or fails the vulnerability test.
12 . The method of claim 7 , wherein the virtualized environment is Infrastructure as a Service (IaaS).
13 . The method of claim 7 , wherein the virtualized environment is Amazon Web Services (AWS).
14 . The method of claim 7 , the inventory information associated with the pre-release version of the machine image of the software object comprises a set of installed software, configuration information, or a combination thereof.
15 . A vulnerability management system, comprising:
a memory; and
at least one processor communicatively coupled to the memory, the at least one processor configured to:
receive, from a software object development system, inventory information associated with a pre-release version of a machine image of a software object;
perform a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object;
determine one or more scan results based on the vulnerability scan; and
transmit, to the software object development system, a report comprising the one or more scan results,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
16 . The vulnerability management system of claim 15 , wherein the virtualized environment is Infrastructure as a Service (IaaS).
17 . The vulnerability management system of claim 15 , wherein the virtualized environment is Amazon Web Services (AWS).
18 . The vulnerability management system of claim 15 , the inventory information associated with the pre-release version of the machine image of the software object comprises a set of installed software, configuration information, or a combination thereof.
19 . The vulnerability management system of claim 15 , wherein the determination comprises calculation a vulnerability risk score associated with the vulnerability scan.
20 . The vulnerability management system of claim 19 ,
wherein the report indicates whether the vulnerability risk score is below a threshold, or
wherein the report indicates the vulnerability risk score, or
wherein the report indicates whether the pre-release version of the machine image of the software object passes or fails a vulnerability test based on the vulnerability risk score.
21 . A software object development system, comprising:
a memory; and
at least one processor communicatively coupled to the memory, the at least one processor configured to:
generate a pre-release version of a machine image of a software object;
transmit, to a vulnerability management system, inventory information associated with the pre-release version of the machine image of the software object; and
receive, from the vulnerability management system, a report comprising one or more scan results associated with a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
22 . The software object development system of claim 21 , wherein the at least one processor is further configured to:
determine whether the pre-release version of the machine image of the software object passes or fails a vulnerability test based on the one or more scan results.
23 . The software object development system of claim 22 , wherein the at least one processor is further configured to:
release the pre-release version of the machine image of the software object if the pass or fail determination determines that the pre-release version of the machine image of the software object passes the vulnerability test.
24 . The software object development system of claim 22 , wherein the pass or fail determination is based on a vulnerability risk score associated with the pre-release version of the machine image of the software object.
25 . The software object development system of claim 24 ,
wherein the report indicates whether the vulnerability risk score is below a threshold, or
wherein the report indicates the vulnerability risk score, or
wherein the report indicates whether the pre-release version of the machine image of the software object passes or fails the vulnerability test.
26 . The software object development system of claim 21 , wherein the virtualized environment is Infrastructure as a Service (IaaS).
27 . The software object development system of claim 21 wherein the virtualized environment is Amazon Web Services (AWS).
28 . The software object development system of claim 21 , the inventory information associated with the pre-release version of the machine image of the software object comprises a set of installed software, configuration information, or a combination thereof.
29 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a vulnerability management system, cause the vulnerability management system to:
receive, from a software object development system, inventory information associated with a pre-release version of a machine image of a software object;
perform a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object;
determine one or more scan results based on the vulnerability scan; and
transmit, to the software object development system, a report comprising the one or more scan results,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
30 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a software object development system, cause the software object development system to:
generate a pre-release version of a machine image of a software object;
transmit, to a vulnerability management system, inventory information associated with the pre-release version of the machine image of the software object; and
receive, from the vulnerability management system, a report comprising one or more scan results associated with a vulnerability scan for a set of known vulnerabilities on the inventory information associated with the pre-release version of the machine image of the software object,
wherein the pre-release version of the machine image of the software object corresponds to a container comprising a set of applications and a virtualized environment in which the set of applications are configured for execution.
31 . The method of claim 1 , wherein the container is an Open Container Initiative (OCI)-compliant container.
32 . The method of claim 31 , wherein the OCI-compliant container is a Linux container.
33 . The method of claim 32 , wherein the Linux container is a docker container.
34 . The method of claim 1 , wherein the pre-release version of the machine image of the software object corresponds to an Amazon Machine Image (AMI).