4 ms·
My impression of container scanners has always been that they are security theatre. Something that lets companies say 'look how security conscious we are'. Same
by c7DJTLrn 6y ago
My impression of container scanners has always been that they are security theatre. Something that lets companies say 'look how security conscious we are'. Same for code scanners.
If an automated process really could find vulnerabilities to the same fidelity as a human pentester, that would be groundbreaking. In most cases, companies don't want to fork out the cost for real security, so they run these useless scanners instead.
- cube00 6y agoI lost all respect for those scanners after I found one was flagging libraries (even the latest) because it had an open ended version range. Upon digging into why it was because "the library has an insecure mode in it" and the warning will remain until the library authors remove that mode. Here's a better idea, how about you flag when I actually use the mode? If I don't use it, don't flag and let me get on with my real job. To top off the scanner didn't support suppressing single vulnerabilities so our options were (1) the build remained "unstable" forever or (2) we ignore the scanning result so we can get back to a stable build.
- brendoelfrendo 6y agoI mean, plenty of human pen-testers also use automated tools. It's common knowledge (or at least I thought it was) that these scanners produce contextless output that is going to require analysis in order to be useful. The scanner is just looking for known vulnerabilities; that's a useful tool, because you don't necessarily need to know that a CVE was published to know that it exists in your environment. A human still needs to step in and match that finding to a real risk of exploitation.