Poster: Are we reasoning about cloud application vulnerabilities in the right way? 1st Stefano Simonetto Department of Pervasive Systems University of Twente Enschede, The Netherlands s.simonetto@utwente.nl 2nd Peter Bosch Department of Pervasive Systems University of Twente Enschede, The Netherlands h.g.p.bosch@utwente.nl Abstract—Enterprises are quickly transitioning to container orchestrators, like Kubernetes, which helps developers and en- gineers manage a large number of container images, pods, and nodes. However, this new approach does not solve the problem of software vulnerabilities but arguably it makes vulnerability management harder. Most of the time, companies have to deal with thousands of containers in a dynamic environment since they can fail, and be rescheduled in other nodes. All these factors have a great impact on the vulnerability management system because the vulnerabilities and misconfigurations in the system are too many to be manually operated, so we seek a tool to highlight the most dangerous (we need a clear definition of dangerous) to prioritize them. This paper wants to emphasize the need for a vulnerability prioritization method and a defense technique improvement. Index Terms—Vulnerability, Prioritization, Container orches- tration, Attack kill-chain. I. INTRODUCTION Cloud application vulnerabilities have devastating conse- quences on our digital society, threatening our privacy, fi- nances, and critical infrastructure. CISQ (Consortium for Information and software quality) estimates that the cost of poor software quality in the US has grown to at least $2.41 trillion, but not in similar proportions as seen in 2020. The accumulated software Technical Debt (TD) has grown to roughly $1.52 trillion [2]. In the past few years, the research community proposed sophisticated approaches and techniques to enhance automated security testing and promptly identify vulnerabilities before they can be exploited by malicious attackers. As a result, today a large variety of tools are available to effectively detect vulnerabilities. However, most organizations do not know how to deal with the tons of vulnerabilities also because these tools are prone to produce false positives. The usual behavior is to patch them based on the score produced by each individual vulnerability. As if the problem wasn’t complicated enough, the container orchestration scenario makes the situation more challenging due to the rapid and continuous deployment of new containers and pods in such environments. In the real world, attackers put together multiple vulnerabilities to successfully compromise systems as shown in Fig.1 which is taken from a real attack scenario and is related to the ATT&CK framework [5]. Thus, analyzing vulnerabilities in combination with each other represents a fundamental step to obtain a realistic “big picture” of their implications. Furthermore, most defensive solutions are reactive solutions, like intrusion detection systems, system calls monitoring, etc. Even if these techniques are very well-established, they are affected by scalability problems and are not meant to prevent an attack to happen. This poster’s abstract aims to create a discussion on how vulnerabilities are managed in the container orchestration environment and particularly in Kubernetes. More precisely, why don’t we prioritize the software patches according to the real attack path instead of focusing on a single score? And if this is possible, can we automate this discovering-fixing process? Can we be more proactive during the defense? Fig. 1. Real attack path in Kubernetes environment II. PROBLEM STATEMENT Bug-finding approaches have arguably become too success- ful thanks to: 1) fuzzers which inject automatically semi-random data into a program/stack and detect bugs, 2) scanners that identify vulnerabilities relying on a database of known vulnerabilities. Industries are finding more vulnerabilities than they can fix promptly. This leads to a kno