Loading…
May 10-12, 2023
Vancouver, British Columbia, Canada + Virtual
View More Details & Registration
Note: The schedule is subject to change.

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for Open Source Summit North America 2023 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

This schedule is automatically displayed in Pacific Daylight Time (UTC/GMT -8). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.

Back To Schedule
Friday, May 12 • 3:10pm - 3:50pm
Automating the DoD Container Hardening Pipeline - Russ Andersson, RapidFort

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
The Department of Defense’s security group, Platform One, maintains a centralized hardened container registry called Iron Bank. This DevSecOps initiative ensures containers meet strict safety and security requirements for use across DoD infrastructure. DoD engineers have been building automated container hardening pipelines. Container vulnerability counts have reduced as much as 95%, averaging 70% across the board. Despite the significant reduction in container footprint and software packages, they are fully-functional and exceed Iron Bank security specs. In this talk, cybersecurity engineer David Dooley will walk through the methodologies being used to instrument, harden, test, and optimize these containers. Learn how the DoD employs container vulnerability scanning, testing, reduction, automation, and other open source technologies. For example, Iron Bank NGINX pre- and post-hardening: Size: 261.18MB => 24.74MB (91%) Vulnerabilities: 102 => 25 (75%) Packages: 225 => 73 (68%) Iron Bank Redis pre- and post-hardening: Size: 287.32MB => 39.3MB (86%) Vulnerabilities: 98 => 5 (95%) Packages: 220 => 5 (98%)
Speakers
avatar for Russ Andersson

Russ Andersson

COO & Co-Founder, RapidFort
Russ is interested in helping solve some of the most pressing challenges in Software Supply Chain Risk, and is engaged with a number of Federal entities.At Rapidfort, we specialize in container security, SCA scanning, and vulnerability management. Our work has been instrumental in... Read More →

Friday May 12, 2023 3:10pm - 3:50pm PDT
119 (Level 1)
  OpenGovCon, How to Build Safe and Secure Systems Using Software You Didn’t Write!