Security Center:Configure and perform image security scans

Usage notes

• Image repositories to scan: Container Registry (ACR) Enterprise Edition image repositories that you created and Harbor, Quay, and GitLab image repositories that you added to Security Center.

• Scan scope: By default, the scan uses all check items for all image repositories. You can set the scan scope as needed. The scan scope includes image repositories, baseline check items, vulnerability whitelists, whitelists of sensitive file types, and whitelists of at-risk files. For more information, see Step 1: Configure the image security scan scope.

• Scan method: Perform an immediate image security scan (manual scan) and configure a periodic image security scan.

  Both manual and periodic scans are performed based on the scan scope settings.

• Resource consumption for scan tasks: Security Center identifies an image by its digest value. If the digest value of an image does not change, only the first scan consumes a quota unit. If the digest value changes, a new scan consumes another quota unit.

  Before you scan images, make sure that you have a sufficient Container Image Scan quota. For more information, see Enable the Container Image Security Scan service.

• Scan duration: To ensure the stability of image scan tasks, Security Center sets the timeout period for each image scan task to 4 hours. This value cannot be changed. After 4 hours, the task stops even if some image repositories in the task are not scanned.

  Note

  Before you perform an image scan task, we recommend that you specify the required image repositories. If you specify a Harbor image repository, you can configure the Speed Limit to improve the image scan efficiency. For more information, see the Manage image repositories section in this topic.

Step 1: Configure the image security scan scope

The scan scope configuration takes effect for both manual and periodic scans.

1. Log on to the Security Center console. In the top-left corner of the console, select the region of the assets that you want to protect: Chinese MainlandChina or Outside Chinese Mainland. In the navigation pane on the left, choose Protection Configuration > Container Protection > Container Image Scan.

2. In the upper-right corner of the Container Image Scan page, click Scan Settings.

3. Click the tab for a feature to configure its scan scope.

   Configure scan parameters

   In the Scan Settings panel, click the Scan Configuration tab and configure the parameters.

   Configuration item	Description
   Consumed Quota/Purchased Quota	The number of image scans that are performed and the total number of image scans that are allowed. If the number of image scans that are allowed is near exhaustion, you can click Scale Out to purchase more image scans.
   Scan Cycle	Select a cycle to perform image security scans. This parameter takes effect only for periodic scans.
   Scan Scope	Set the scope of image repositories to scan. Perform the following steps: Click Manage to the right of Scan Scope. In the Image Management dialog box, select the image repository that you want to scan. By default, Automatically Adds New Image Repositories For Scan is enabled in the upper-right corner of the image repository list. This means that the system automatically adds new image repositories to the scan scope for periodic image security scans. You can click the switch icon to disable this feature. Click OK.
   Scan Time Range	Select a time range for the image vulnerability scan. Important The scan time range is based on the local update time of the image. If no update time is available, the local creation time of the image is used. The time range determines whether an image is scanned. For example, if you set the scan time range to Last 7 Days, Security Center will scan images that were updated within the last 7 days. If an update time is available but the image was last updated more than 7 days ago, the scan task status is successful, but the number of successful scans is 0. If no update time is available and the image was created more than 7 days ago, the image is not scanned, similar to the preceding scenario.
   Vulnerability Retention Period	Set the retention period for the results of periodic image vulnerability scans. Security Center automatically deletes the scan results of vulnerabilities that are outside the retention period.

   Manage image repositories

   You can click the Image Repository tab to view the list of Container Registry Enterprise Edition instances of the acr type that support scanning, and private image repositories that you have connected of types such as harbor, quay, and gitlab.

   Note

   • Security Center automatically syncs Container Registry Enterprise Edition instances from your Alibaba Cloud account to the image repository list. You cannot remove Container Registry Enterprise Edition instances from the image repository list.

   • You can click Task Management in the upper-right corner of the Container Image Scan page. Then, on the Container Asset Synchronization and Image Asset Synchronization tabs, view the asset synchronization progress and status.

   • To scan a private image repository that is not in the image repository list, you can click Add Image Repository to add the repository. For more information, see Add image repositories.

   • If you do not want to scan a private image repository in the image repository list, click Remove in the Actions column for the repository. In the dialog box that appears, click OK to remove the repository.

     Note

     The two default image repositories (repository types: acr and defaultAcr) in the image repository list cannot be deleted.

   • For a Harbor image repository, you can click Edit in the Actions column to configure the Throttling for image scanning to improve the efficiency of image security scans. Throttling specifies the number of images that can be scanned per hour. The default value is 10.

     For example, if a harbor image repository contains 200 images and you use the default speed limit, the image scan task requires 20 hours to complete. However, the global timeout for each scan task is 4 hours. This means that not all images in the repository can be scanned. If you set the Speed Limit parameter to 200, the scan task requires only 1 hour to complete. You can configure the Speed Limit parameter based on your needs and network conditions.

   Configure image baseline scans

   While configuring image vulnerability scans, you can also configure image baseline checks.

   1. In the Scan Settings panel, click the Baseline Configuration Management tab.

   2. Click Manage to the right of Configuration Scope.

   3. In the Baseline Check Scope panel, select the baselines that you want to check, and click Confirm.

      Important

      The Access Key Plaintext Storage and Password Leakage baseline checks in the Baseline Check Scope panel correspond to the AccessKey Leak Detection and Password Leak Detection checks, respectively. If you select the Access Key Plaintext Storage and Password Leakage baselines in the Baseline Check Scope panel, the switches for AccessKey Leak Detection and Password Leak Detection under Baseline Configuration Management are automatically enabled, so you do not need to set them again. You can also use the switches next to AccessKey Leak Detection and Password Leak Detection to enable or disable these two baselines.

   Once configured, the system will check the baseline configuration of your images whenever you click Scan Now or a configured periodic scan starts.

   Immediately perform a container runtime image scan

   The container runtime image scan feature helps you detect security risks in the container runtime.

   Important

   Container runtime image scans support only manual scans. You cannot set periodic scans.

   1. Log on to the Security Center console. In the top-left corner of the console, select the region where your assets are located: China or Outside China. In the navigation pane on the left, choose Protection Configuration > Container Protection > Container Image Scan.

   2. In the upper-right corner of the Container Image Scan page, click Scan Settings.

   3. In the Scan Settings panel, click the Container Runtime Image Scan tab.

   4. Click Configure Scan Scope. In the dialog box that appears, select the required cluster and the name of the application that you want to scan, and click OK.

   5. Click Scan Now.

   After you run an immediate scan, you can click Task Management in the upper-right corner of the Container Image Scan page. In the Task Management panel, click the Container Runtime Image Scan tab to view the scan progress. After the scan is complete, you can view the detected vulnerabilities on the Image Vulnerability Risk tab of the Container Image Scan page.

   Configure image sensitive file scans

   The image sensitive file scan feature detects sensitive data in common sensitive files and your custom image files. It can detect various sensitive file types, such as application configurations that contain sensitive information, common certificates and keys, application authentication or logon credentials, and credentials from Elastic Compute Service vendors. This feature helps you find sensitive information in the image environment. You can then handle the detected sensitive data to improve the security of the image runtime environment.

   Important

   Only static image scans are supported. Runtime sensitive file detection is not supported.

   1. In the Scan Settings panel, click the Sensitive File Scan Settings tab.

   2. Click Manage to the right of Configuration Scope.

   3. In the Sensitive File Scan Settings panel, select the check items to scan.

      

   4. Turn the sensitive file detection switch on or off.

      After you enable the sensitive file detection switch, a sensitive file scan is also performed when you click Scan Now or when a periodic scan runs.

   Configure a whitelist for at-risk files

   If you do not want to receive alerts for risks from a specific image sensitive file, image build instruction, or malicious image sample, you can add the corresponding alert type to a whitelist. Security Center does not generate alerts for risks that are on the whitelist.

   Note

   • The whitelist for at-risk files displays alert types and image repositories that you have added to the whitelist from the Malicious Image Sample, Sensitive Image File, and Image Build Command Risks tabs. For more information, see Handle detected image risks.

   • You cannot configure a whitelist for at-risk files the first time you use the image security scan feature.

   1. In the Scan Settings panel, click the At-risk File Whitelist Configuration tab.

   2. Configure the whitelist for at-risk files.

      • Edit a whitelist rule: On the Sensitive File, Container Build, or Malicious Sample tab, find the target Alarm Metric, click Edit in the Actions column, and then select All Image Repositories or Current Image Repository Only as the whitelist scope.

      • Delete a whitelist rule: On the Sensitive File, Container Build, or Malicious Sample tab, find an alert type and click Delete in the Actions column to remove the alert type from the whitelist. Security Center will then resume detecting and generating alerts for these risks.

   Configure image fixing

   Security Center supports automatic fixing of system vulnerabilities for ACR Enterprise Edition image repositories. You can enable automatic fixing and configure the fixing cycle, fixing scope, and other parameters.

   1. In the Scan Settings panel, click the Image Risk Fixing Configuration tab.

   2. Click the Fixing Configuration switch to enable or disable the automatic fixing feature.

   3. If you enable Fixing Configuration, you can configure the Fixing Period, Fixing Scope (the image repositories in an ACR Enterprise Edition instance), and Time Range (vulnerabilities in images that are updated within this time range are fixed).

      Important

      Security Center evaluates the time range condition based on the last update time of an image. If an image has not been updated, its creation time is used. For example, if you set the Time Range to 7 Days, Security Center fixes vulnerabilities only in images that were updated within the last seven days.

      After you click Scan Now or when a periodic scan task that you configure starts, Security Center detects and fixes system vulnerabilities on your images based on the fixing cycle that you specify.

      You can click Task Management in the upper-right corner of the Container Image Scan page. In the Task Management panel, go to the Image Remediation tab to view the remediation status of image system vulnerabilities.

   Configure a vulnerability whitelist

   If you do not need to scan for a specific image vulnerability, you can add the vulnerability to a whitelist. Security Center does not generate alerts for vulnerabilities on the whitelist.

   1. In the Scan Settings panel, click the Vulnerability Whitelist Settings tab.

   2. Configure the vulnerability whitelist.

      • Create a vulnerability whitelist rule: Click Create Rule. In the Create Rule panel, configure whitelist rules for different types of vulnerabilities.

      • Edit a vulnerability whitelist rule: Click Edit in the Actions column of the target whitelist rule to modify its Rule Scope, Image Selection, and Note.

      • Delete a vulnerability whitelist rule: Find the required whitelist rule and click Delete in the Actions column. After the vulnerability is removed from the whitelist, Security Center resumes detecting the vulnerability and generating alerts for it.

4. Click the icon in the upper-right corner of the Scan Settings panel to close the panel.

Step 2: Perform an image security scan

After you configure the image security scan scope, manual scans and periodic scans are performed based on the configuration settings in the Scan Settings panel.

Step 3: View the progress and status of an image scan task

1. In the upper-right corner of the Container Image Scan page, click Task Management.

2. In the Task Management panel, click the Image Scan tab.

3. After you view the progress and status of the task, click Details in the Actions column to view its execution log.

   For example, you can view information about the image for which the task failed and the cause of the failure.

   

Appendix