DevOps Security in DevOps Flashcards

24 sample cards from the Security in DevOps deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is Clair?

   An open-source project for the static analysis of vulnerabilities in container images (originally from CoreOS), which indexes image layers and matches installed packages against known CVE databases.

2. How does Clair detect vulnerabilities in container images?

   It statically analyzes each image layer, extracts the list of installed packages, and cross-references them against vulnerability data sources (CVE feeds) to report known vulnerabilities; it does not run the container.

3. What is container security?

   The practice of securing containerized applications and their infrastructure across the lifecycle—image, registry, orchestration (e.g., Kubernetes), and runtime—covering image scanning, configuration hardening, access control, and runtime threat detection.

4. What are the typical phases of the container security lifecycle?

   Build (scan images, secure base images), Ship/Registry (signing, registry access control), and Run (runtime protection, network policies, monitoring)—often summarized as build, ship, and run.

5. Why are minimal/distroless base images recommended for container security?

   They contain fewer packages and tools, which shrinks the attack surface, reduces the number of potential CVEs, and removes shells/utilities an attacker could abuse.

6. What does image scanning detect in container security?

   Known vulnerabilities (CVEs) in OS packages and application dependencies, embedded secrets, malware, and misconfigurations within a container image before deployment.

7. What is an SBOM (Software Bill of Materials)?

   A formal, machine-readable inventory of all components, libraries, and dependencies in a piece of software, used to track provenance and quickly assess exposure to newly disclosed vulnerabilities.

8. What does CVE stand for and what is it?

   Common Vulnerabilities and Exposures—a standardized identifier (e.g., CVE-2021-44228) for a publicly disclosed security vulnerability, enabling consistent reference across tools and databases.

9. What is CVSS and what range does its base score use?

   Common Vulnerability Scoring System—a standard for rating the severity of vulnerabilities. The base score ranges from $0.0$ to $10.0$, with higher values indicating greater severity.

10. State the CVSS severity rating bands.

    None: $0.0$; Low: $0.1\text{–}3.9$; Medium: $4.0\text{–}6.9$; High: $7.0\text{–}8.9$; Critical: $9.0\text{–}10.0$.

11. What is the OWASP Top 10?

    A regularly updated awareness document listing the ten most critical web application security risks (e.g., Broken Access Control, Injection, Cryptographic Failures), used to prioritize defenses.

12. What is injection (e.g., SQL injection) and a primary defense?

    Injection occurs when untrusted input is interpreted as part of a command/query, letting attackers execute unintended operations. Primary defenses: parameterized queries/prepared statements and input validation.

13. What is broken access control?

    A failure to properly enforce restrictions on what authenticated users can do, allowing unauthorized access to data or functions (e.g., IDOR, privilege escalation). It is the OWASP Top 10 #1 risk in the 2021 list.

14. What is the difference between authentication and authorization?

    Authentication verifies who a user is (identity); authorization determines what an authenticated user is permitted to do (access rights).

15. What is secrets management in DevSecOps?

    Securely storing, accessing, and rotating sensitive credentials (API keys, passwords, tokens, certificates) using tools like vaults, instead of hardcoding them in source code or config files.

16. What is policy as code?

    Expressing security and compliance policies in a high-level declarative language (e.g., Open Policy Agent/Rego) so they can be version-controlled and automatically enforced in pipelines and at runtime.

17. Where in a CI/CD pipeline is SAST typically run versus DAST?

    SAST runs early—on commit/build against source code. DAST runs later—against a deployed/running application in a test or staging environment after the build is deployed.

18. What is a security gate (quality gate) in a CI/CD pipeline?

    An automated checkpoint that fails the build or blocks promotion when security criteria are not met (e.g., a critical vulnerability is found), preventing insecure code from progressing.

19. What is the difference between agentless and agent-based runtime container security?

    Agent-based deploys a sidecar/agent inside the host or pod to monitor and enforce at runtime (deeper visibility); agentless inspects via APIs or snapshots without installing software in the workload (lower overhead, less runtime control).

20. What is a false negative in security testing and why is it dangerous?

    A false negative is a real vulnerability that the tool fails to report. It is dangerous because the flaw remains undetected and exploitable, giving a false sense of security.

21. What does 'attack surface' mean?

    The sum of all points (entry/exit points, interfaces, services, code paths) where an attacker can try to enter, extract data from, or exploit a system; reducing it lowers risk.

22. Which tool would you use to scan a Docker image for known CVEs: OWASP ZAP, Clair, or both?

    Clair—it statically analyzes container image layers for known CVEs. OWASP ZAP is a DAST tool for running web applications, not image scanning.

23. Compare Snyk and Clair in scope.

    Snyk is a broad commercial platform covering dependencies (SCA), code (SAST), containers, and IaC with fix automation. Clair is a focused open-source tool that only performs static vulnerability scanning of container images.

24. What is image signing and why does it matter for container security?

    Cryptographically signing container images (e.g., with Cosign/Notary) verifies their origin and integrity, ensuring only trusted, untampered images are deployed and preventing supply-chain tampering.

What this deck covers

Security in DevOps flashcards FAQ