Automated container security
Architectures and techniques are described that can automate container security elements in the context of applications being deployed on a container orchestration platform. Techniques detailed herein can serve to increase awareness of container product security in an automated manner, can automate processes on detecting security vulnerabilities and bringing down insecure workspaces, can automate processes for mitigating the security vulnerabilities, notifying, verifying, and bringing the associated containers back online.
1. A device, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
scanning containerized applications deployed on a container orchestration platform and identifying a vulnerability of a containerized application of the containerized applications;
performing a vulnerability mitigation procedure that identifies solution data based on a source of the vulnerability, where in the source represents a portion of the containerized application that exhibits the vulnerability, and wherein the solution data is indicated to mitigate the vulnerability of the containerized application and is determined in response to building a docker file that is constructed as a function of the source of the vulnerability;
determining a confidence score indicative of a likelihood that the containerized application to function nominally after application of the solution data that is selected as a function of the source of the vulnerability; and
in response to the confidence score being above a defined threshold, applying the solution data to the containerized application.
2. The device of claim 1 , wherein the solution data is at least one of:
update data that, when applied, updates the containerized application, patch data that, when applied, patches the containerized application, or vulnerability removal data that, when applied removes a dependency of the containerized application.
3. The device of claim 1 , wherein the solution data is identified in response to comparing the vulnerability to a common vulnerabilities and exposures database.
4. The device of claim 1 , wherein the confidence score is determined as a function of a history of success resulting from previously applying the solution data to other containerized applications.
5. The device of claim 1 , wherein the vulnerability mitigation procedure further comprises determining, from among multiple sections of the containerized application, the source of the vulnerability.
6. The device of claim 1 , wherein the source of the vulnerability is one of:
a first source indicative of the vulnerability being in a base image, a second source indicative of the vulnerability being in an operating system dependency, a third source indicative of the vulnerability being in a driver, or a fourth source indicative of the vulnerability being in a Python dependency.
7. The device of claim 1 , wherein the vulnerability mitigation procedure identifies multiple instances of solution data and selects from among the multiple instances of solution data the solution data that is determined to have a highest respective confidence score.
8. The device of claim 1 , wherein the multiple instances of solution data are determined as a function of the source of the vulnerability.
9. The device of claim 1 , wherein the operations further comprise generating report data that describes the vulnerability.
10. The device of claim 9 , wherein the report data comprises a first reference to the vulnerability and a second reference to the solution data.
11. The device of claim 9 , wherein the operations further comprise transmitting the report data to a customer device of an entity that manages the containerized application.
12. The device of claim 1 , wherein identifying the vulnerability of the containerized application comprises determining that a vulnerability severity score indicative of a severity of the vulnerability is above a severity threshold.
13. A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
in response to parsing containerized applications deployed on a container orchestration platform, identify a vulnerability of a containerized application of the containerized applications and a source of the vulnerability, wherein the source represents a portion of the containerized application that exhibits the vulnerability;
perform a vulnerability mitigation procedure that identifies solution data as a function of the source of the vulnerability, wherein the solution data mitigates the vulnerability and is generated in response to building a docker file constructed as a function of the source of the vulnerability;
determine a confidence score indicative of a likelihood that the containerized application functions nominally after application of the solution data, wherein the solution data is determined based on the source of the vulnerability; and
in response to the confidence score being above a defined threshold, apply the solution data to the containerized application.
14. The non-transitory computer-readable medium of claim 13 , wherein
the solution data is identified in response to comparing the vulnerability to a common vulnerabilities and exposures database.
15. The non-transitory computer-readable medium of claim 13 , wherein the confidence score is determined as a function of a history of success resulting from previously applying the solution data to other containerized applications.
16. The non-transitory computer-readable medium of claim 13 , wherein the vulnerability mitigation procedure further comprises determining, from among multiple sections of the containerized application, the source of the vulnerability.
17. A method, comprising:
in response to scanning containerized applications deployed on a container orchestration platform, identifying, by a device comprising a processor, a vulnerability of a containerized application of the containerized applications, and identifying a source of the vulnerability, wherein the source represents a portion of the containerized application that exhibits the vulnerability;
performing, by the device, a vulnerability mitigation procedure that identifies, based on the source of the vulnerability, solution data that is indicated to mitigate the vulnerability of the containerized application, wherein the solution data is determined in response to building a docker file constructed as a function of the source of the vulnerability;
determining, by the device, a confidence score that is indicative of a probability that the containerized application functions nominally after application of the solution data that is selected as a function of the source of the vulnerability; and
in response to the confidence score being above a defined threshold, applying, by the device, the solution data to the containerized application.
18. The method of claim 17 , further comprising generating, by the device, report data that describes the vulnerability comprising a first reference to the vulnerability and a second reference to the solution data.
19. The method of claim 17 , further comprising transmitting, by the device, the report data to a customer device of an entity that manages the containerized application.
20. The method of claim 17 , further comprising identifying, by the device, the vulnerability of the containerized application comprises determining that a vulnerability severity score indicative of a severity of the vulnerability is above a severity threshold.