Hi, my name is Zach Roof,
and welcome to the cybersecurity course featuring Trivy.
Trivy is primarily maintained by Teppei Fukuda.
Now, Teppei, if you're listening to this and I totally butchered
your name, just please forgive me. My intentions are pure. Okay,
now if you go through Trivy's GitHub issues, you will witness
Teppei's dedication to the project.
I mean, in fact, Aqua Security,
a security vendor, hired Teppei so he could work on Trivy full time.
So obviously, I'm not the only one who has witnessed his
dedication. Anyhow, I just want to thank Teppei and his sponsor,
Aqua Security, for providing this wonderful project. Now, you
might be wondering, well, what is Trivy?
Well, Trivy is a simple and comprehensive vulnerability scanner for
containers, suitable for continuous integration.
Before we go further,
I just want to say a prerequisite for this course is
basic container or Docker knowledge.
Now, if you don't have this knowledge,
I'm going to do my best to fill in the gaps. However,
if you're still feeling kind of left out,
please check out the Getting Started with Docker course
here, on Pluralsight. I highly recommend it.
So in the next slide, we'll start to get a high‑level overview of Trivy.
Trivy detects vulnerabilities within OS packages.
Now this could be Alpine, Red Hat Enterprise Linux, Debian,
Ubuntu, Amazon,
Linux, the list goes on and on, and also, application dependencies.
This could be Node, Ruby, Python, Java, etc. Trivy is also fast.
The first Trivy scan will take roughly 10 seconds to complete.
Subsequent scans will only take a few seconds. Now, other scanners can
sometimes take up to 10 minutes on the first run and encourage you to
maintain a vulnerability database. By contrast,
Trivy's stateless and requires no maintenance or preparation.
Now, because Trivy is fast, we can integrate Trivy directly into
development workflows. In other words,
as engineers update code, this code can be tested in
real time for vulnerabilities.
Okay,
let's do a little framework action and see how Trivy fits
into the NIST cybersecurity framework.
The framework is divided into three parts, core, profile, and tiers. The
framework core that is currently on the screen contains high‑level best
practices for cybersecurity and risk management, in general. Trivy primarily
sits within the identify and protect functions.
Let's dive into this a little bit more.
Then, this framework defines categories for every function.
Trivy primarily sits within two categories, risk assessment and
information protection processes and procedures.
As they say,
it's turtles all the way down, so let's dig into these
specific subcategories for Trivy.
As a brief aside,
I'm going to quickly go through the framework sections so we
can get to the demos as quickly as possible.
First off, asset vulnerabilities are identified and documented, so Trivy
will help us audit vulnerabilities within our Docker images, and
configuration change control processes are in place. In this course,
we're going to be leveraging GitHub Actions to implement change control
processes through the lens of Trivy.
In other words,
we're going to be doing some pretty sweet automation. MITRE ATT&CK
coverage for Trivy is going to setter upon the infrastructure analysis
area. For the purposes of this course, we'll focus our defenses on two
attack techniques. Supply chain compromise.
So within the context of this course,
this is really software supply chain compromise.
In other words,
one of the packages that is used by an application such as
Python or a package that is used by the operating system has a
disclosed vulnerability. Notice that I say disclosed. Trivy does
not find new vulnerabilities.
It simply looks up the version of a given package in its
own internal vulnerability database.
Now,
the information in this database comes from publicly
available vulnerability feeds.
Okay, and the second attack we're going to see in this course, implant
container image. When an attacker uploads a malicious Docker image
directly to the Docker registry, we need a way to check for this
tampering and also to do forensics on the image.
We're going to do this forensics through Google's container‑diff
and through Trivy. It's going to be pretty sweet.
Now we're going to check out the MITRE Shield section. In
particular, we see the MITRE ATT&CK technique,
supply chain compromise, mapped to the MITRE Shield active defense.
In this course, we're going to see examples of these defenses.
So first off is decoy network. A defender can install any
suspect hardware or software on an isolated system or network
and monitor for non‑standard behaviors.
We're going to do this leveraging a GitHub feature called GitHub Actions.
It's going to be pretty awesome.
Now we see the second attack technique in this course, implant container image.
This is mapped to the behavioral analytics defense.
Now a defender can monitor user interactions with images and containers to
identify ones that are added or altered anomalously.
In this course,
we're going to be looking at the signatures of Docker images
and see when tampering is present. At a very high level, we're
going to view how Trivy works.
It all starts with the Docker image registry.
The registry houses Docker images. Now as far as
where the registry can be located,
it can be in your data center or cloud, or it could be hosted by a third party.
In this course, we're going to be using Docker Hub, a
third‑party Docker registry. The server uses a Docker image
to instantiate a Docker container.
This container can contain anything.
For example, the container on the screen can be a running Apache Server.
And, in general, this process is similar to how a virtual machine
image is used as the basis for a virtual machine.
The virtual machine is instantiated from the virtual machine image.
The attackers.
Okay, so what are they doing?
Well, there's a couple of different attack paths here.
First, they can upload a malicious image directly to the Docker registry.
Now an example of this could be, say,
a version of Apache that contains the Heartbleed vulnerability.
So the next time the server downloads the Docker image and runs the container,
it will now be vulnerable.
The other attack path is just to exploit the Docker container directly.
For example, the Apache Docker container isn't up to date on patches.
In that case, the attacker could use Metasploit or some other
offensive framework to exploit these various weaknesses.
Trivy audits Docker images that are housed within this registry.
In this course, we will find proactive ways to mitigate both attack paths.
Alright, while these diagrams were needed to lay our foundation,
I'm starting to get some PowerPoint fatigue. From here on out,
we'll be in the demo environment getting some hands‑on experience.
Next up is installing the demo environment.