Shift security left : Dev idea , Dev env, staging env, prod env

faster feedback, lest cost,

• CI/CD Pipeline
• SCA : Static Code Analysis (scan without running code)
  • SCA : Static Composition Analysis
  • SAST : Static Application Security Testing
  • Secret Scanner
• precommit: lancer analyses au plus tôt
• Sbom : Software Bill of materials (liste des dépendances avec versions) : ex quand une vulnérabilité est découverte on peut find grep dedans
• DAST : Dynamic Application Security Testing (SQL injection, xss , session hijacking, authenticaion,...) (ex. Owasp Zap tool)
• Image Scanners
• Alpine image: less attack surface (but still OS)
• Distroless images: even less tools (usually image providers give a lot more infos such as Sbom, Security infos, ...)

https://edu.chainguard.dev/chainguard/chainguard-images/getting-started-distroless

https://images.chainguard.dev

docker scout cves $APP_NAME:APP_VERSION --output vuln.report

docker scout cves $APP_NAME:APP_VERSION --only-severity critical --exit-code

docker scout sbom --output $APP_NAME.sbom $APP_NAME:APP_VERSION

• Generate vulnerability report (and notify the team)

• Fail CI on vulnerability threshold

• Sign commit

• Sign image