From the Enterprisers Project: 5 DevSecOps Open Source Projects to Know

The always wonderful Enterprisers Project has a new round up of important DevSecOps Projects you should probably know about. Hats off to Gordon Haff for writing this up. From the article:

1. Clair

Vulnerability scanning should be considered table stakes as part of a DevSecOps automated CI/CD workflow. This scanning can take place in multiple places across the workflow – and scanning should continue once software is deployed into production as new threats defined on the Common Vulnerabilities and Exposures database (CVE) are discovered and as changes can occur in deployed images.

Clair is an open source project for the static analysis of vulnerabilities in application containers. Clair is an API-driven analysis engine that inspects containers layer-by-layer for known security flaws. Using Clair, you can build services that provide continuous monitoring for container vulnerabilities.

This type of service is particularly important when organizations download container images directly. However, even when building containers from source, vulnerabilities can creep in over time as new security exploits are discovered.

Check out the full article over at the Enterprisers Project.