You've just completed the course.
Wahoo!
Before I let you go,
let's check out some additional information to take
your Trivy skills to the next level.
Before we proceed,
just note that all the links that you're about to see are housed within the
GitHub README that you saw at the beginning of this course.
Okay, cool.
Let's keep going.
So, Trivy's README contains some great command‑driven examples.
It also has examples of how Trivy can be leveraged in other
continuous integration systems while we looked at GitHub
Actions through our examples of Travis CI,
CircleCI, etc.
Trivy also has the ability to be embedded within VS Code.
The more that you can integrate Trivy into the IDE, the better.
Earlier in this course, we explored how to filter Trivy results.
We filtered by severity and by vulnerabilities that don't have a fix.
But what if you'd like to be more granular?
Trivy can be integrated with the Open Policy Agent.
At a high level, this allows you, the blue teamer,
to create more granular filtering policies.
To dive deeper into this integration, I highly recommend Teppei's KubeCon talk,
Handling Container Vulnerabilities with Open Policy Agent.
It's pretty sweet.
Trivy can also be integrated into various Docker registries.
For example, Trivy can be integrated into the Harbor Docker registry.
For an example of this integration, please check out the link.
For Docker image registry tampering to occur,
the Docker registry credentials must be compromised.
For an example, please see my other Pluralsight course,
Infrastructure Analysis with kube‑hunter.
You go through a pretty intricate example of how this can occur.
For more information on the container‑diff tool, please check out the README.
Earlier in this course,
I briefly said that a very determined attacker could
undermine Google's container‑diff tool.
Let's dive into this for a moment.
Specifically, each Docker image has a unique history that can be inspected.
This history can show what changes have occurred within the image.
At this link, the author shows how an attacker can control this history.
In other words,
when the container‑diff tool reports Docker history changes from one Docker
image to another, this finding cannot be completely trusted.
Now,
that does not mean that all output from Google's container‑diff tool
cannot be trusted. In this course, we use Google's container‑diff tool
to generate the signature of a Docker image.
Just as an aside, that output can be trusted.
Okay.
And we also see GitHub Actions overview.
For high‑level overview of how GitHub Actions work, I highly
recommend checking out their documentation.
Well, that's a wrap.
I hope this course was useful and allowed you to see the power of
Trivy within your blue team workflows. As always,
I'd love to stay in contact.
If you'd like to contact me personally, please go to my website,
zachroofsec.com, and also feel free to follow me on Twitter.
I look forward to interacting with you.