包阅导读总结
1. 关键词：Docker Scout、健康分数、容器图像、软件安全、供应链
2. 总结：本文介绍了 Docker Scout 健康分数这一新功能，用于对 Docker Hub 中的容器图像进行安全评级，其具有字母分级系统，依据多种因素计算，旨在简化软件安全，已在部分组织试用，鼓励组织加强容器环境的安全管理。
3. 主要内容：
– Docker Scout 健康分数介绍：
– 是为开发者简化软件安全的新功能。
– 解决开发者缺乏安全专业知识的痛点。
– 工作原理：
– 采用字母 A 到 F 的分级系统。
– 通过一系列安全和合规检查计算分数，考虑多种因素。
– 健康分数的查看有隐私限制。
– 在 Docker Hub 中的作用：
– 由 Docker Scout 提供支持。
– 融入开发者的图像生命周期管理工作流程。
– 方便开发者查看和采取改进措施。
– 其他方面：
– 具有游戏化元素，激励开发者提高分数。
– 目前作为测试版推出，部分组织参与早期访问计划，可反馈。
思维导图：
文章地址：https://www.docker.com/blog/docker-scout-health-scores-security-grading-for-container-images/
文章来源：docker.com
作者：Tazin Progga
发布时间：2024/7/30 6:29
语言：英文
总字数：727字
预计阅读时间：3分钟
评分：82分
标签：Docker Scout,容器安全,Docker Hub,DevSecOps,安全评级
以下为原文内容
本内容来源于用户推荐转载，旨在分享知识与观点，如有侵权请联系删除 联系邮箱 media@ilingban.com
Docker Scout Health Scores: Security Grading for Container Images in Your Docker Hub Repo
We are thrilled to introduce Docker Scout health scores, our latest feature designed to make software security simpler and more effective for developers.
Developer-friendly software security
Docker Scout health scores rate the security and compliance status of container images within Docker Hub, providing a single, quantifiable metric to represent the “health” of an image. This feature addresses one of the key friction points in developer-led software security — the lack of security expertise — and makes it easier for developers to turn critical insights from tools into actionable steps.
How Docker Scout health scores work
Docker Scout health scores utilize an alphabetical grading system to rate images stored in Hub repositories. The scores range from A to F, with A representing the highest overall standing and F the lowest. These health scores are calculated by evaluating images against a set of security and compliance checks based on widely accepted secure supply chain best practices. Factors considered include known vulnerabilities, risky licenses, Software Bill of Materials (SBOM) availability, provenance attestations, freshness of base image, and more. To learn more about these checks and the scoring process, visit our documentation.
Note: To maintain the privacy of these assessments, health scores can only be viewed by users who are members of the Docker Hub organization that owns an image repository and have at least “read” access to the repository.
The power of Docker Scout within Docker Hub
Health scores are powered by Docker Scout, our secure software supply chain tool that empowers organizations to strengthen their containerized application security posture via detailed analysis and insights across the software supply chain. Additionally, Docker Scout evaluates container images against detailed policies to ensure compliance with security and licensing standards.
By embedding Docker Scout’s powerful analysis capabilities into Docker Hub, health scores seamlessly fit into developers’ image lifecycle management workflows. Developers visiting hub.docker.com can leverage up-to-date and dependable assessments of their latest and historical images and take proactive measures to prioritize and improve images with lower scores.This capability is crucial for protecting containerized applications from potential security threats.
Figure 1 shows an example of an image with a low health score. The image was awarded a D score because it contains at least one known, high-profile CVE (think Log4Shell), is missing supply chain attestations (like SBOM and provenance), is using an out-of-date base image, and has specified a default root user.
Health scores in Docker Hub
We’ve made it straightforward for developers to leverage health scores. Users can view them directly within the Docker Hub interface by navigating to their organization’s Repositories tab (Figure 2) or from the detailed view for any given repository (Figure 3).
For those seeking more in-depth analysis, enabling Docker Scout for a specific image repository offers easy access to detailed secure software supply chain insights and recommendations for how to address identified issues (Figure 4).
Proactive security through gamification
In addition to making convoluted secure supply chain insights easier to digest, health scores also introduce an element of gamification. Within our own teams at Docker, we are seeing them motivate developers to improve the container images for which they’re responsible. With the clear, quantifiable A to F metric, developers are taking the initiative to pursue higher scores through proactive steps. This process has fostered a culture of continuous improvement, where our developers are self-motivated to prioritize corrective actions and updates to achieve better scores, thus bolstering the security and compliance of our own portfolio.
Conclusion
By leveraging Docker Scout health scores, we aim to encourage organizations to take proactive steps towards better security and compliance management in their containerized environments and increase the overall resilience of their software supply chain.
The feature is currently available as beta and rolled out to a limited number of organizations that have been selected to participate in the early access program. To try out health scores or to give feedback, reach out to our product team on social channels, such as X and Slack.
