TechPrufer
Get started
Palantir
Palantir logoPalantir · Feature trail

Continuous Vulnerability Management

2 posts · May 2021 – Feb 2024

What this trail covers

This post details the evolution of Palantir's approach to continuous and scalable vulnerability management for cloud software products. It introduces the Container Vulnerability Scanner (CVS) as a framework integrating multiple scanning tools (Trivy, ClamAV, Jfrog Xray) to identify vulnerabilities in container images and software dependencies. CVS is coupled with Palantir's Continuous Deployment platform, Apollo, to automate and optimize vulnerability remediation, ensuring compliance with string.

All Palantir trails
  1. Kontinuierliches und skalierbares Schwachstellenmanagement bei PalantirThis post introduces Palantir's Container Vulnerability Scanner (CVS) as a framework for continuous and scalable vulnerability management. It details the integration of multiple scanners (Trivy, ClamAV, Jfrog Xray) to scan container images and software dependencies. The post highlights the coupling of CVS with Apollo for automated remediation and compliance with SLAs, including specific timeframes for different severity levels. It also discusses the use of minimized, scratch-based container images to reduce attack surfaces and the process of scanning software components upon registration in the Apollo catalog before deployment.
  2. Testing in Depth. (Also, please don’t use undeclared dependencies.)This post details a specific bug related to undeclared dependencies in Java projects, exacerbated by transitive dependencies and in-memory integration tests. It highlights the importance of build system tooling (Gradle plugins like checkImplicitDependencies) and the concept of 'Testing in Depth' (layering unit, integration, and post-release monitoring) to prevent such issues from reaching production. The post also touches upon the role of Apollo in automatically rolling back affected releases.