<story><title>The security scanner that cried wolf</title><url>https://pythonspeed.com/articles/docker-security-scanner/</url></story><parent_chain></parent_chain><comment><author>raesene9</author><text>This article shows an interesting contrast between how different types of scanning tools address the issue of valid CVEs for which there are no updates.&lt;p&gt;The question is &amp;quot;do you want to know about a valid CVE if there&amp;#x27;s no patch available&amp;quot;?&lt;p&gt;For high security environments, the answer might be yes (you want to evaluate individual patches to see if they impact your application)&lt;p&gt;For many environments the answer is likely (as is the case with OP) no, you only want to know about issues for which there is an updated package available.&lt;p&gt;Interestingly (well to me :) ) more established scanning tools (e.g. Tenable Nessus) default to &amp;quot;no&amp;quot; on this question and container scanning tools mostly default to &amp;quot;yes&amp;quot;. (I did an example comparison &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;raesene.github.io&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;11&amp;#x2F;22&amp;#x2F;When_Is_A_Vulnerability_Not_A_Vulnerability&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;raesene.github.io&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;11&amp;#x2F;22&amp;#x2F;When_Is_A_Vulnerab...&lt;/a&gt;)&lt;p&gt;The important part is that your organization makes an informed choice about which works best for them.&lt;p&gt;As a sidenote there are also differences in severities and how vulnerabilities are counted (e.g. if you have multiple issues in a package do you count each one or just count once for that package) which can lead to different numbers of issues being reported by different scanners. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;raesene.github.io&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;06&amp;#x2F;21&amp;#x2F;Container_Vulnerability_Scanning_Fun&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;raesene.github.io&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;06&amp;#x2F;21&amp;#x2F;Container_Vulnerab...&lt;/a&gt;</text></comment>
<story><title>The security scanner that cried wolf</title><url>https://pythonspeed.com/articles/docker-security-scanner/</url></story><parent_chain></parent_chain><comment><author>c7DJTLrn</author><text>My impression of container scanners has always been that they are security theatre. Something that lets companies say &amp;#x27;look how security conscious we are&amp;#x27;. Same for code scanners.&lt;p&gt;If an automated process really could find vulnerabilities to the same fidelity as a human pentester, that would be groundbreaking. In most cases, companies don&amp;#x27;t want to fork out the cost for &lt;i&gt;real&lt;/i&gt; security, so they run these useless scanners instead.</text></comment>