{"id":596741,"date":"2023-01-12T05:49:12","date_gmt":"2023-01-12T11:49:12","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/01\/12\/cncf-accepts-kubescape-as-its-first-security-and-compliance-scanner-project\/"},"modified":"2023-01-12T05:49:12","modified_gmt":"2023-01-12T11:49:12","slug":"cncf-accepts-kubescape-as-its-first-security-and-compliance-scanner-project","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/01\/12\/cncf-accepts-kubescape-as-its-first-security-and-compliance-scanner-project\/","title":{"rendered":"CNCF accepts Kubescape as its first security and compliance scanner project"},"content":{"rendered":"
<\/p>\n
\n
\n
\n<\/figure>\n

ARMO\u2019s open source security<\/a> project Kubescape is now part of the Cloud<\/a> Native Computing Foundation\u2019s (CNCF<\/a>) sandbox in an attempt to \u201cbecome that free, open source, end-to-end security platform,\u201d according to Craig Box, VP of open source at ARMO.<\/p>\n

It was always part of the plan to donate the open source security scanner to the CNCF, he said, citing the difference between DevOps teams\u2019 ideal use of software and code \u2013 in an open, transparent way as part of a community \u2013 and the way most security vendors design proprietary solutions.<\/p>\n

Box dove into the details of the Kubescape project and what it means to be the first security scanner donned by the CNCF over an email-conducted interview.<\/p>\n

SDxCentral: <\/b>How does Kubescape work, and what problems does it aim to solve?<\/p>\n

Box: <\/b>Kubescape is an open-source Kubernetes<\/a> security solution. It scans for misconfigurations inside manifest files like YAML and Helm throughout the CI<\/a>\/CD [continuous integration\/continuous delivery<\/a>] pipeline and inside Kubernetes clusters. It also scans for vulnerabilities (CVEs) in container image registries (e.g. docker.io<\/a>. Quay.io, ECR, etc.) and images inside clusters.<\/p>\n

It helps DevOps\/DevSecOps to understand their Kubernetes security posture, evaluate their security risks, and suggest fixes and remediation paths to harden the environment.<\/p>\n

Kubescape can easily be integrated into different CI\/CD tools like Jenkins, CircleCI, GitHub Actions, GitLab, IDEs (i.e. Visual Studio Code) Prometheus, Lens, Docker, and others to provide security insights where and when the user needs them. It can help companies achieve security compliance like SOC2<\/a> using different industry frameworks like CIS, NSA, and MITRE.<\/p>\n

Kubescape aims to solve two big problems:<\/p>\n