Hacker News Reader

Comment by eyegor | Hacker News Reader

Besides pointing pentester tools like metasploit at yourself, there are some nice scanners out there. Examples in no particular order:

https://github.com/quay/clair

https://github.com/anchore/grype/

https://github.com/eliasgranderubio/dagda/

https://github.com/aquasecurity/trivy

So then you set up something like a cron job to scan everything for you and email the results once a week or whatever if you don't want to monitor things actively.

View on HN

I just setup GVM / OpenVAS[0] to work out where I need to put in some maintenance work, how does that rate as worthwhile in comparison to those you've listed above? (which I will also look into).

(not a fan of the effort Greenbone have gone to for hiding their community edition and promoting their commercial products)

[0]: https://greenbone.github.io/docs/latest/22.4/container/index...

Thanks for these. I should have clarified, I'm more interested in something that will alert me when newly-discovered vulnerabilities surface. The systems I maintain are protected [enough] today but a new hack could drop that doesn't make mainstream media and I may not hear about it. We have annual security audits but it would be nice to patch things immediately. Aside from subscribing to a security forum/discord/slack, I'm wondering what other methods folks are employing to solve this.

Keep your pentesting tools up-to-date. Run them against yourself on every single deployment, if you can. Don't just run them quarterly because that's all that your PCI-DSS requirements say you have to do.

Integrate security code scanning tools into your CI/CD process. Tools like Dry Run Security, or something comparable.

There's much more, but that has to do with how to run your CI/CD systems and how to do your deployments in general, and less to do with security aspects thereof.

For Gentoo: glsa-check --list

Reply on news.ycombinator.com