Security Center:Configure and run image security scans

Usage

• Scannable repositories: Container Registry Enterprise Edition image repositories that you created and Harbor, Quay, and GitLab image repositories that you added to Security Center.

• Scan scope: By default, image security scans cover all image repositories and check items. You can configure the scan scope, including specific image repositories, baseline check items, a vulnerability whitelist, a sensitive file type whitelist, and an at-risk file whitelist. For more information, see Step 1: Configure the image security scan scope.

• Scan method: Perform an immediate image security scan (manual scan) and Configure a periodic image security scan (periodic scan).

  Both manual and periodic scans use the configured scan scope.

• Quota consumption: Security Center identifies an image by its digest. If an image's digest is unchanged, the first scan consumes one quota authorization. Subsequent scans of an image with a changed digest consume additional authorizations.

  Before performing an image security scan, ensure that you have sufficient Container Image Scan authorizations. For more information, see Enable the Container Image Scan service.

• Scan duration: To ensure the stability of scan tasks, Security Center sets the timeout period for each image scan task to 4 hours. This value cannot be changed. A scan task times out after 4 hours and stops, even if it has not finished scanning all specified image repositories.

  Note

  To improve scan efficiency, specify the target image repositories before scanning. For Harbor image repositories, you can also configure a Speed Limit. For more information, see the Manage image repositories section in this topic.

Step 1: Configure the image scan scope

The configured scan scope applies to both manual and periodic scans.

1. Log on to the Security Center console. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Image Scan. In the upper-left corner of the console, select the region where the assets that you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

2. In the upper-right corner of the Container Image Scan page, click Scan Settings.

3. Click a feature tab to configure the scan scope for the image scan task.

   Scan parameters

   Parameter	Description
   Consumed Quota/Purchased Quota	Displays the used and purchased quota for container image scans. If your quota is low, click Scale Out to purchase more.
   Scan Cycle	Select a frequency for container image scans. This parameter applies only to periodic scans.
   Scan Scope	Specify the image repositories to scan. Perform the following steps: Click Manage to the right of Scan Scope. In the Image Management dialog box, select the checkboxes of the image repositories that you want to scan. By default, Automatically Adds New Image Repositories for Scan is enabled in the upper-right corner of the repository list. This means that if new image repositories are added, they are automatically included in the scan scope for periodic scans. You can click the switch to disable this feature. Click Confirm.
   Scan Time Range	Select a time range for the image vulnerability scan. Important The scan time range is determined by the local update time of an image. If the update time is unavailable, the local creation time of the image is used. The time range determines whether an image is scanned. For example, if you set the scan time range to Last 7 Days, Security Center scans images that were updated within the last 7 days. If an update time is available but the image was last updated more than 7 days ago, the scan succeeds, but reports that zero images were scanned. If no update time is available and the image was created more than 7 days ago, the image is not scanned.
   Vulnerability Retention Period	Specify the retention period for the results of periodic vulnerability scans. Security Center automatically deletes scan results that are older than the retention period.

   Image repositories

   You can click the Image Repository tab to view the list of scannable Container Registry Enterprise Edition instances (repository type: acr) and connected private image repositories (repository types: harbor, quay, gitlab, and others).

   Note

   • Security Center automatically synchronizes Container Registry Enterprise Edition instances under your Alibaba Cloud account to the image repository list. You cannot remove Container Registry Enterprise Edition instances from the list.

   • You can click Task Management in the upper-right corner of the Container Image Scan page and go to the Container Asset Synchronization and Synchronize Image Asset tabs to view the asset synchronization progress and status.

   • To scan a private image repository that is not in the list, click Add Image Repository to connect your private image repository. For more information, see Connect an image repository.

   • To remove a private image repository from the scan list, click Remove in its Actions column and then click Confirm in the confirmation message.

     Note

     The two default image repositories (repository types: acr and defaultAcr) in the list cannot be removed.

   • For a harbor image repository, you can click Edit in the Actions column to configure Speed Limit for the image scan to improve scan efficiency. Throttling specifies the number of images that can be scanned per hour. The default value is 10.

     For example, a harbor image repository contains 200 images. If you use the default throttling setting, the scan takes 20 hours to complete. However, the global timeout period for each scan task is 4 hours, which means not all images can be scanned. If you set the throttling value to 200, the scan completes in only 1 hour. You can configure this parameter based on your business requirements and network conditions.

   Image baseline scan

   You can configure check items for the image baseline scan when you set up image vulnerability scans.

   1. In the Scan Settings panel, click the Baseline Configuration Management tab.

   2. Click Manage to the right of Scan Scope.

   3. In the Baseline Check Scope panel, select the baselines that you want to check, and then click OK.

      Important

      The AccessKey Stored in Plaintext and Password Leak baseline checks in the Baseline Check Scope panel correspond to AccessKey Leak Detection and Password Leak Detection, respectively. If you select the AccessKey Stored in Plaintext and Password Leak baselines in the Baseline Check Scope panel, the switches for AccessKey Leak Detection and Password Leak Detection under Baseline Configuration Management are automatically enabled. You do not need to set them again. You can also use the switches next to AccessKey Leak Detection and Password Leak Detection to quickly enable or disable these two baselines.

   After the configuration is complete, Security Center checks the baseline configurations of your images during a Scan Now operation or a scheduled periodic scan.

   Runtime image scan

   The container runtime image scan feature helps you detect security risks in your container runtime environment.

   Important

   The container runtime image scan feature supports only manual scans, not periodic scans.

   1. Log on to the Security Center console. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Image Scan. In the upper-left corner of the console, select the region where the assets that you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

   2. In the upper-right corner of the page, click Scan Settings.

   3. In the Scan Settings panel, click the Container Runtime Image Scan tab.

   4. Click Configure Scan Scope. In the dialog box that appears, select the cluster and applications to scan, and then click Confirm.

   5. Click Scan Now.

   You can view the scan progress on the Container Runtime Image Scan tab in the Tasks panel. After the scan is complete, view the detected vulnerabilities on the Image Vulnerability tab of the Container Image Scan page.

   Sensitive file scan

   The sensitive file scan for images feature detects sensitive data within your image files, including in common and custom file types. Examples of sensitive data include application configurations, generic certificates and keys, authentication credentials, and cloud service provider credentials. Promptly addressing detected sensitive data improves the security of your image runtime environment.

   Important

   This feature supports only static image scanning, not runtime detection.

   1. In the Scan Settings panel, click the Sensitive File Scan Settings tab.

   2. Click Manage to the right of Scope.

   3. In the Sensitive File Scan Settings panel, select the check items that you want to scan.

   4. Turn the sensitive file detection switch on or off.

      If you enable this feature, a sensitive file scan is also performed during a Scan Now operation or a scheduled periodic scan.

   At-risk file whitelist

   If you do not want to receive alerts for risks related to sensitive image files, image build instructions, or malicious image samples, you can add the corresponding alert types to a whitelist. The system does not detect whitelisted risks.

   Note

   • The at-risk file whitelist displays the alert types and image repositories that have been added to the whitelist from the Malicious Image Sample, Sensitive Image File, and Image Build Command Risks lists. For more information, see Remediate image scan risks.

   • You must run a scan at least once before you can configure the at-risk file whitelist.

   1. In the Scan Settings panel, click the Configure Whitelist for At-risk Files tab.

   2. Configure the whitelist for at-risk files.

      • Edit a whitelist rule: On the Sensitive File, Container Build, or Malicious Sample tab, find the target alert type, click Edit in the Actions column, and then select a rule scope: All Image Repositories or Current Image Repository Only (select the image repositories that you want to add to the whitelist).

      • Delete a whitelist rule: On the Sensitive File, Container Build, or Malicious Sample tab, find the target alert type and click Delete in the Actions column to delete the rule. After a rule is deleted from the whitelist, Security Center resumes detecting the related risks and generating alerts.

   Image fixing

   Security Center supports automatic fixing of system vulnerabilities in image repositories of Container Registry Enterprise Edition. You can enable automatic fixing and configure parameters such as the fixing period and scope.

   1. In the Scan Settings panel, click the Image Risk Fixing Configuration tab.

   2. Click the Fixing Configuration switch to enable or disable automatic fixing.

   3. If you enable this feature, you can configure the Fixing Period, Fixing Scope (image repositories of Container Registry Enterprise Edition), and Time Range (images that are updated within the specified time range are fixed).

      Important

      The fixing time range is determined by the update time of an image. If the update time is unavailable, the creation time of the image is used. The time range determines whether an image is fixed. For example, if you set the time range to Last 7 Days, Security Center fixes images that were updated within the last 7 days. Images that were updated more than 7 days ago are not fixed.

      After you perform the Scan Now operation or after a configured periodic scan runs, system vulnerabilities in the target image are regularly identified and fixed based on the remediation cycle that you set.

      You can click Task Management in the upper-right corner of the Container Image Scan page and go to the Image Risk Fixing tab in the Task Management panel to view the fixing status of system vulnerabilities in images.

   Vulnerability whitelist

   If you do not need to scan for a specific image vulnerability, you can add the vulnerability to a whitelist. The system does not detect whitelisted vulnerabilities.

   1. In the Scan Settings panel, click the Vulnerability Whitelist Settings tab.

   2. Configure the vulnerability whitelist.

      • Create a rule: Click Create Rule to add custom whitelist rules for different vulnerability types.

      • Edit a rule: Find the rule that you want to edit, click Edit in the Actions column, and then modify the Applied Assets, Select Image, and Description of the rule.

      • Delete a rule: Find the rule that you want to delete and click Delete in the Actions column. After a rule is deleted, Security Center resumes detecting the corresponding vulnerability and generating alerts.

4. Click the close icon in the upper-right corner of the panel to close the Scan Settings panel.

Step 2: Run a container image scan

After you configure the scan scope, both manual scans and periodic scans run based on the settings in the Scan Settings panel.

Step 3: View image scan progress and status

1. In the upper-right corner of the Container Image Scan page, click Task Management.

2. In the Task Management panel, click the Image Scan tab.

3. Click Details in the Actions column to view the task's execution log.

   For example, for a failed task, you can identify the problematic image and the cause of the failure.

Appendix