Docker-Security icon indicating copy to clipboard operation
Docker-Security copied to clipboard

Published 20 hours ago • verified publisher icon OWASP

D02 - Patch Management Strategy Suggestion

Open coderpatros opened this issue 4 years ago • 0 comments

Suggestion to include guidance on tracking the components in your base image, and your own bundled software, as part of D02.

There are tools like Anchore Syft that can generate a software bill of materials for container images. This information can be fed into tools like OWASP Dependency-Track for continuous analysis. And identification of vulnerable components.

It also helps address OWASP Top 10 A9:2017-Using Components with Known Vulnerabilities, and activities identified in the OWASP SCVS.

coderpatros avatar Jun 04 '21 11:06 coderpatros