February 2020 Summaries

The blog post discusses how to implement container image scanning in CircleCI using Sysdig Secure to identify and prevent vulnerabilities and misconfigurations before they reach production environments. Sysdig Secure allows DevOps teams to enforce image policies and detect issues such as unsafe Dockerfile instructions, vulnerabilities in base image operating systems, and compliance violations. It highlights the benefits of Sysdig's inline scanning feature, which sends only results to the Sysdig Secure backend, available as SaaS or air-gapped, ensuring image security without exposing them to external repositories. The process involves integrating Sysdig Secure into a CircleCI pipeline, building an OCI image with Docker, and scanning it to prevent non-compliant images from proceeding to production. The scanning results, including details on vulnerabilities and configuration issues, are accessible through Sysdig Secure, and if the image passes the scan, it is published to the repository. The post emphasizes the importance of embedding security and compliance in the CI/CD pipeline to ensure robust and secure Kubernetes environments.

Sysdig Secure has introduced Role-Based Access Control (RBAC) to enhance its enterprise readiness by ensuring separation of duties and least privilege access among different teams, which is crucial for organizations adopting container and Kubernetes security tools. The platform now supports four user roles—View Only, Standard User, Advanced User, and Team Manager—each with distinct access levels to manage security features within their scopes. This allows for precise control over who can access and modify certain security settings, with the admin role retaining full management capabilities. RBAC in Sysdig Secure enables developers to access only their specific cluster or application, while security teams can access broader components, excluding account administration and billing. Additionally, external auditors can receive separate access controls for comprehensive security assessments. This functionality is aligned with the needs of DevOps teams to maintain security and compliance without unnecessary privilege grants that could lead to account compromises.