DevConf.cz 2021

How can you be sure your bare metal, virtual machines or containers are secure and do not contain any known vulnerabilities? How much can you trust your security scanner? How has the security scanning landscape changed over the years and what is next? What are the proverbial pits that security scanners often fall into? Those are some of the questions that we will try to answer in this talk. These answers largely depend on what security metadata is available for the software you are using and so we will cover common security metadata formats, sources and how to use them effectively. We will focus on standard formats such as OVAL and CVRF and several vendor sources