WEBVTT

00:00:01.040 --> 00:00:03.940
Hello, and a very warm welcome to this course,

00:00:03.950 --> 00:00:07.020
Protective Technology with Dockle.

00:00:07.020 --> 00:00:10.130
My name is Peter Mosmans, and I'm a lead penetration tester,

00:00:10.140 --> 00:00:12.460
as well as DevSecOps consultant.

00:00:13.540 --> 00:00:15.850
This is a different course than usual.

00:00:16.340 --> 00:00:18.860
This one revolves around a single tool.

00:00:19.340 --> 00:00:23.150
It contains lots of demos, lots and lots of demos.

00:00:24.040 --> 00:00:25.860
So, Dockle, what exactly is it?

00:00:26.540 --> 00:00:30.050
Dockle is a container image linter focused around security,

00:00:30.540 --> 00:00:33.360
and it helps you to build best‑practice Docker images.

00:00:35.340 --> 00:00:36.740
In my humble opinion,

00:00:36.750 --> 00:00:40.380
one of the things that makes Dockle so great is how easy it is to

00:00:40.390 --> 00:00:43.380
integrate in your continuous integration environments.

00:00:43.570 --> 00:00:44.640
Within no time,

00:00:44.640 --> 00:00:47.080
you'll be up and running and performing Dockle

00:00:47.080 --> 00:00:49.650
security scans over your Docker images.

00:00:50.340 --> 00:00:52.650
This is what we're going to do in this course.

00:00:54.140 --> 00:00:57.760
In other words, Dockle is very easy to use.

00:00:59.040 --> 00:01:03.560
It was originally created by Tomoya Amachi in 2019 and

00:01:03.560 --> 00:01:05.750
written in the Go programming language.

00:01:05.860 --> 00:01:08.160
Thank you, Tomoya, for such a great tool.

00:01:10.040 --> 00:01:13.760
The source code of Dockle is licensed under the Apache License.

00:01:14.340 --> 00:01:16.000
You can build it from source,

00:01:16.440 --> 00:01:19.870
but there are also multiple binaries available for multiple platforms,

00:01:19.880 --> 00:01:20.760
as we shall see.

00:01:21.640 --> 00:01:24.850
And, even better, there are Docker images available,

00:01:25.840 --> 00:01:29.760
which makes it very easy to use in continuous integration environments.

00:01:31.540 --> 00:01:34.800
The source code and more information can be found on GitHub

00:01:34.850 --> 00:01:37.510
under the address goodwithtech/dockle.

00:01:37.510 --> 00:01:43.030
In order to make a good use case to start using Dockle,

00:01:43.030 --> 00:01:46.650
let's take a brief look at the NIST Cybersecurity Framework.

00:01:47.340 --> 00:01:50.850
This is a framework developed with the goal to reduce cyber risks.

00:01:51.340 --> 00:01:53.260
It is voluntary guidance.

00:01:53.940 --> 00:01:56.320
As you can see, it has multiple functions,

00:01:56.330 --> 00:02:00.150
identify, protect, detect, respond, and recover.

00:02:01.240 --> 00:02:05.350
Dockle fits under the protect function of the Cybersecurity Framework.

00:02:06.340 --> 00:02:09.699
If you want to know more about the NIST Cybersecurity Framework,

00:02:09.710 --> 00:02:12.440
I'd urge you to take a look at Pluralsight where there are

00:02:12.440 --> 00:02:14.760
several courses available on this subject.

00:02:16.240 --> 00:02:19.150
For Dockle, we're interested in the protect function.

00:02:19.740 --> 00:02:22.950
That function itself is divided into multiple categories.

00:02:23.640 --> 00:02:26.060
We have identity management and access control,

00:02:26.640 --> 00:02:30.060
awareness and training, data security,

00:02:30.840 --> 00:02:33.560
information protection processes and procedures,

00:02:34.240 --> 00:02:38.050
maintenance, and protective technology.

00:02:38.940 --> 00:02:40.860
Protective technology?

00:02:41.640 --> 00:02:43.160
Yes, Dockle.

00:02:44.340 --> 00:02:47.350
Subcategories that are applicable for Dockle are,

00:02:47.350 --> 00:02:48.310
number 3,

00:02:48.580 --> 00:02:51.970
the principle of least privilege is incorporated by configuring

00:02:51.970 --> 00:02:54.950
systems to provide only essential capabilities,

00:02:55.440 --> 00:02:59.550
and 4, communications and control networks are protected.

00:03:00.240 --> 00:03:03.390
This is what you can achieve by using Dockle.

00:03:03.390 --> 00:03:07.440
Enough about the theory about why you should use it. Let's

00:03:07.450 --> 00:03:10.660
immediately start with a demo about the basic usage.