Cyril Bouchiat
Rajat Luthra
Running an efficient vulnerability management program has become increasingly challenging as deployment pace accelerates, technologies diversify, and ephemeral resources multiply. This makes it harder for organizations to keep up with vulnerabilities, improve their security posture, and meet compliance standards like SOC 2, PCI, HIPAA, and FedRAMP. DevOps and security teams often find themselves overwhelmed, spending days fixing non-exploitable issues while lacking visibility into the exploitable and zero-day vulnerabilities that legitimately threaten their production environments.
From CI/CD pipelines to live production resources, Datadog Cloud Security continuously scans your containers, hosts, and serverless functions for vulnerabilities. Cloud Security Vulnerabilities employs runtime observability to help teams prioritize and remediate exploitable vulnerabilities within their daily workflows, making Datadog the single pane of glass for both infrastructure and security teams.
In this post, we’ll discuss how Cloud Security can help you:
With the sizable number of containers and hosts running in a cloud environment, each operating with different packages and versions, it can be challenging to continually track existing and new vulnerabilities. Many vulnerability management programs miss the full picture by focusing only on the build phase and neglecting vulnerabilities in production. With updates being constantly pushed to production and critical CVEs emerging daily, effective vulnerability management requires continuous detection—from CI/CD pipelines to live environments—to obtain the full picture.
Cloud Security Vulnerabilities provides complete end-to-end visibility by continuously scanning hosts, host images, container images, and serverless functions for vulnerabilities across live production resources, container registries, and CI/CD pipelines, using either Agentless scanning or the Datadog Agent. Because you can’t protect what you can’t see, Datadog provides a real-time inventory of your container images, host images, hosts, serverless, and infrastructure packages, so you can globally review your coverage and identify vulnerable assets.
The Cloud Security Vulnerability Explorer provides a centralized view as a starting point so you can deep-dive into vulnerabilities across your entire infrastructure. Each team can filter and investigate vulnerabilities affecting their hosts and container images using infrastructure tags for deeper visibility.
Cloud Security Vulnerabilities helps you prioritize exploitable vulnerabilities first, fast-tracking their remediation while keeping teams’ velocity up. This also helps security teams assess the blast radius of a critical emerging vulnerability in seconds.
Datadog assigns exploitable vulnerabilities a Datadog Severity Score, which combines the vulnerability’s Common Vulnerability Scoring System (CVSS) base severity with several risk factors, including:
Combining these factors helps you accurately identify the top 5 percent of exploitable critical vulnerabilities, so your team can remain productive while addressing highest risk.
You can select a particular vulnerability to access more details, such as a description of the issue, its severity score, and a list of affected infrastructure. Cloud Security Vulnerabilities also provides recommended steps for resolving the issue.
You can also quickly identify the teams, resources, and packages with the most exploitable vulnerabilities, helping you prioritize your remediation efforts.
Cloud Security also offers triaging options for managing detected vulnerabilities. You can assign vulnerabilities to individual owners for remediation and tracking, and use the “Status” facet to sort issues based on where they are in the remediation process.
Cloud Security significantly reduces time to remediation with guided, one-click remediation steps, empowering DevOps engineers to resolve multiple exploitable vulnerabilities in minutes. Cloud Security pinpoints which container base image, container layer, or host image introduces vulnerabilities and recommends the image or package version you should upgrade to in order to remediate most issues at once.
To remediate even faster, Cloud Security uses deployment context to identify hosts deployed in the same autoscaling group that are using the same image. In the example below, Cloud Security recommends upgrading the host image for an autoscaling group, enabling you to fix 975 vulnerabilities across all affected hosts at once. Fixes can be deployed with a single click, using auto-generated PRs through Infrastructure-as-Code.
With Cloud Security, you can steer your vulnerability management program towards autopilot by automating most tasks and using out-of-the-box reporting.
Cloud Security uses Automation Pipelines to automate the vulnerability remediation process while helping you meet the requirements of the most demanding compliance frameworks.
Automation Pipelines supports:
Cloud Security Automation Pipelines is now in Preview—to sign up, fill out this form.
Cloud Security also offers an out-of-the-box dashboard that makes it easy to track the progress of your vulnerability management program and report to stakeholders.
All vulnerabilities, software bills of materials (SBOMs), and coverage data are accessible via our public API, allowing you to easily integrate Cloud Security Vulnerabilities in your existing flows.
Using runtime observability, Cloud Security enables you to secure your infrastructure by detecting, prioritizing, and providing tools to efficiently remediate the most critical exploitable vulnerabilities throughout your pipelines and production environment. To learn more about using Datadog Cloud Security, check out the Cloud Security documentation. If you don’t already have a Datadog account, you can try Cloud Security by signing up for a 14-day free trial today.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。