ISACA Podcast
--% time saved
Loading episode data...
Original episode
PodcastISACA Podcast
Publisher/creatorISACA Podcast
Published
Shortcast updated
Listen to the original episode
About this episode
Containers run much of the software we depend on, and many are shipped with security problems that no one noticed. Traditional container scanning tools can miss important vulnerabilities, insecure configurations, embedded secrets, and risky Dockerfile patterns before they reach production.
In this episode, ISACA’s Adedayo Ojo, Principal, Emerging Technologies and Professional Practices, Research Development, speaks with Advait Patel, Senior Site Reliability Engineer at Broadcom, Docker Captain, and Google Developer Expert in Google Cloud, about why traditional container scanning misses so much and what it takes to identify the issues that matter most.
Advait shares lessons from running containers at scale on a large cloud platform and explains how he built DockSec, an open-source tool that uses AI to identify insecure Dockerfile patterns, embedded secrets, and misconfigurations that signature-based scanners tend to overlook. The conversation offers practical guidance that developers and security teams can apply immediately, along with an honest look at where AI can strengthen container security—and where it cannot.
Related Resources & Stay Connected
Explore DockSec on GitHub: Review the open-source DockSec project, explore its features, and learn how it uses AI to identify insecure Dockerfile patterns, embedded secrets, and container misconfigurations. https://github.com/OWASP/DockSec
Learn More About DockSec from OWASP: Discover more about the DockSec project, its approach to container security, and how it helps developers identify risks that traditional signature-based scanners may miss. https://owasp.org/DockSec/
Connect with Advait Patel on LinkedIn: Follow Advait for insights on container security, cloud infrastructure, site reliability engineering, Docker, and AI-powered security. https://www.linkedin.com/in/advaitpatel93/
Explore Advait Patel’s GitHub: View Advait’s open-source projects, technical work, and contributions to cloud and container security. https://github.com/advaitpatel
Explore More ISACA Podcast Episodes: Dive deeper into cybersecurity, governance, risk, privacy, and emerging technology insights. https://www.isaca.org/resources/news-and-trends/isaca-podcast-library
Subscribe to ISACA on YouTube: Stay ahead with expert interviews, industry analysis, and cybersecurity leadership insights. https://www.youtube.com/@IsacaHq
Don’t forget to like, comment, and subscribe for more conversations shaping the future of IT, cybersecurity, governance, risk, and emerging technology.
Episode summary
This AI-generated Shortcast summary may omit nuance. Use the original episode when context or exact wording matters.
Hi, thank you for listening to Asaka Podcast. I’m Dio Joe with Broadcom’s Advait Patel. Why do vulnerabilities and misconfigurations reach production?
Most tools scan one slice, not the whole pie. They produce giant CVE lists, while remediation and best practices beyond rules get missed. With AI changing threats, we must challenge findings, not just check old lists.
Across Dockerfiles and images, what recurs and what needs attention first?
The big four are root containers, hard-coded secrets, outdated base images, and old libraries. Root comes first: you hand an attacker the key. They can move into networks, hosts, databases, product, and customers. Restrict unneeded permissions first.
You built DocSec from those gaps. What pushed you to create it?
Frankly, software and security engineers want the same destination, but reports with hundreds of findings bury developers. DocSec is an open-source AI container-security analyzer that works with existing tools. It prioritizes five critical issues and points to the file, line, and needed change.
AI is everywhere. Where is it useful, and where should leaders be careful?
AI is fabulous for repetitive pattern work across thousands of lines. But do not give an agent root access, unchecked API calls, or business-critical decisions. It can lie confidently. Use it with human approval, auditability, policies, and guardrails—not as the boss.
A container may look small, but it can open wider infrastructure. Start simple: no root, no embedded secrets, maintained base images, updated libraries. Let AI find patterns, keep people in control of production changes, and secure one container at a time.
It’s been a pleasure talking with you, Advait. Thank you for your time.
Ready to save time?
Download Shortcast and get started today