Activating the module Vulnerability Management (VM)

Vulnerability Management enables you to centrally manage container image vulnerability scanning and view scan results within your workspace.

To get started with Vulnerability Management:

1. Create a service account Vulnerability Management will use to view the info on Container Registry and Cloud Registry registries and Managed Service for Kubernetes clusters.

2. Assign to the service account the security-deck.worker role for the organization, cloud, or folder.

   Note

   Vulnerability Management will only have access to resources residing in the relevant organization, cloud, or folder.

   If you have assigned the role for a particular folder, the service account will also need the auditor role for the cloud.

3. Create a Security Deck workspace configured as follows:

   • In the connector settings under Resources:

     • Select the service account you created earlier.
     • Specify the clouds and folders you want to monitor for container image vulnerabilities.

   • In the Control modules section, select Control modules under Vulnerability Management.

4. Complete Vulnerability Management setup:

   1. Click Workspace parameters on the new workspace page.

   2. Navigate to the Vulnerability management tab.

   3. Under Scope of control, select clouds, folders, or individual registries within the workspace resources for vulnerability detection and control.

      The following options are available:

      • All registries in the workspace: Scan every Container Registry and Cloud Registry in the selected clouds and folders.
      • Only registries in the location selected: Scan registries only in the specified clouds or folders.
      • Only images running in Managed Service for Kubernetes clusters: Scan only images deployed in Managed Service for Kubernetes clusters. This requires Kubernetes® Security Posture Management to be on.

   4. Enable Periodic vulnerability search in registries to regularly scan published images for new vulnerabilities:

      • Select how often to run the scan.

      • Optionally, enable Only scan images with the latest tag or the most recently added ones to scan only the latest image versions. This will reduce scan time and exclude outdated builds from the scan.

        For more on image tags, see Docker image version control.

   5. Enable Vulnerability searches when adding images to registries to detect known vulnerabilities in the supply chain.

      Note

      Vulnerability scanning of newly added images is only available in Cloud Registry.

   6. Click Save and confirm the action.