Research Article
Containers’ Privacy and Data Protection via Runtime Scanning Methods
@INPROCEEDINGS{10.1007/978-3-030-93479-8_3, author={Francisco Rojo and Lei Pan}, title={Containers’ Privacy and Data Protection via Runtime Scanning Methods}, proceedings={Broadband Communications, Networks, and Systems. 12th EAI International Conference, BROADNETS 2021, Virtual Event, October 28--29, 2021, Proceedings}, proceedings_a={BROADNETS}, year={2022}, month={1}, keywords={DevSecOps DevOps Containers Docker Containers security Docker security Containers vulnerability scanner Containers vulnerability assertion Vulnerability scan}, doi={10.1007/978-3-030-93479-8_3} }- Francisco Rojo
Lei Pan
Year: 2022
Containers’ Privacy and Data Protection via Runtime Scanning Methods
BROADNETS
Springer
DOI: 10.1007/978-3-030-93479-8_3
Abstract
Docker containers’ privacy and data protection is a critical issue. Unfortunately, existing works overlook runtime scanning methods. This paper proposes a novel lightweight and rapid scanning model under a framework covering assertion techniques during the container’s runtime, defined asvulnerability scanning frameworkVSF. Our framework includes identifying vulnerability, scanning security exposures, conduct analysis, and call-back notifications to the requestor asynchronously. In addition, the proposed scanning model is compared against other tools of similar and complementary objectives. The framework is modeled usingnmapscripting engine NSE for its active scanning building block. It applies network port scanning and security assertion techniques to rapidly discover security vulnerabilities in a running Docker container environment for a proactive testing approach as a security engine. Also, providing an active trust model developed for Docker containers whether containers areblack-listedorgrey-listed. It was developed over a framework for DevSecOps environments and DevOps teams as the persona on its adoption. The empirical case studies demonstrate the capability of our scanning model, including standalone, CI/CD pipelines, and security containerized environment. The case studies revealed no tangible difference in the performance but the flexibility driven by the modeled architecture. The experiments presented a velocity of( 1.15 \frac{scans}{sec}). However, the execution time is directly proportional to the complexity of the vulnerability on the Docker ecosystem and its related attack vector complexity. Its core capability resides on the artifacts developed as part of the Art per relevant CVE vianmapNSE scripts.
