Hi, everyone, and welcome back.
Now, in today's video, we will be discussing about one of the great security services in ADA, which
is Inspector.
Now, I still remember when Inspector was initially launched, it did the basic job of vulnerability
scanning, but still organizations were a little hesitant on using it as a primary vulnerability scanner.
But over the years, it has made a lot of new updates in terms of features, geo, etc..
Post Which organisations are now migrating to using inspector as a primary vulnerability scanner for
their organization?
So with this, let's go ahead and understand more about this service.
Now Address Inspector is basically similar to a vulnerability scanner which will scan the system for
a specific vulnerability and it provides the result.
This can be understood with a diagram.
You have an inspector through inspector.
You go ahead and scan your easy to instances or a VM and based on the packages that are installed,
vulnerability related results will be displayed to you.
Now again, for the inspector to know what are the package and what are the package versions that are
installed on the AC two instance, it needs to have an agent, so a same agent needs to be installed
at an AC to level and the inspector service will coordinate with the same agent and then you will be
displayed with the vulnerability results.
Now again, it is very similar to that of nurses where an agent is installed and based on the software
packages, it will basically show you the list of vulnerabilities.
Now, again, you will not really expect as good to you as that of nurses, but it can do a pretty good
job as well.
Now, one important part to note of, inspector, is the support scans.
So basically Inspector gives you the flexibility to enable either easy to label scanning or it can also
scan the ACR repository.
So if you have a Docker images uploaded in the ACR inspector can scan that as well.
And in fact, this is a great feature I remember in the initial stages when some of the container scanning,
so there were many organizations that used to do container scanning and that also became one of the
important factors as part of the security audit.
The pricing of those tools were very expensive.
It used to match that of Splunk, so it used to be a great hazard to go ahead and do a container scanning
a few years back, primarily as a was pricing.
However, with inspectors, since it is now supporting the easier related scanning, it has become very
easy again for the organization to make inspector as the primary vulnerability scanner.
So with this base set, let's go ahead and look into it in more detail.
So currently I am within the inspector dashboard and within it basically shows you the overall coverage
in terms of both the instances as well as repository.
And this is great.
So I have two instances that are running in North Virginia region and all of those two instances are
scanned and covered by inspector.
Similarly, I have one easier repository where I have some Docker images available and that repositories
are also scan.
Now based on it, it was able to go ahead and find some findings.
And you have one critical finding specifically in terms of the Docker image that we have as part of
the ACM repository.
Now, you can also see the list of findings in terms of package names.
So let's go ahead and view all the vulnerabilities here.
So it basically shows you that there is one vulnerability related to Python.
So again, the vulnerabilities are divided into multiple severities like Critical High and others.
So let's explore what exactly this vulnerability is all about.
So it gives you the CV details, it gives you the description, and again, it basically gives you the
severity associated with it.
And if you click here, it basically gives you a great detail.
So you do not really need to go to the CV CVS website.
All of the details are given to you out of the box.
And this is the great new feature edition that the inspector has basically added.
If you look into the inspector scope, you see you get the CVSS score, which is 9.8, which is quite
critical.
So if you see something like this, you have to fix it ASAP.
All right.
So this is the basics of what this inspector is all about.
Now, again, at the ACL level as well, you can also see the list of vulnerabilities associated with
a specific container image that is uploaded.
So for one of the container image in this repository, you see you have one critical, which is Python,
and there are certain high level vulnerabilities that are available.
Great.
So this is a very high level overview on what a.
S inspector is all about and its capability to scan both the ESI two instances at the ACL repositories.
So this will conclude today's video.