An analysis of security vulnerabilities in container images for scientific data analysis

Area of Science:

• Computational Neuroscience
• Software Engineering
• Cybersecurity

Background:

• Software containers are crucial for reproducible scientific data analysis.
• Container images frequently contain outdated or unnecessary packages, leading to security vulnerabilities.
• These vulnerabilities pose significant risks to computing infrastructures.

Purpose of the Study:

• To analyze vulnerabilities in container images used for scientific data analysis.
• To evaluate the effectiveness of updating and minifying container images for security.
• To focus on the specific use case of neuroscience data analysis.

Main Methods:

• Utilized 4 different vulnerability scanners for analysis.
• Focused on container images for neuroscience data analysis.
• Quantified the impact of image updates and package removal on vulnerability counts.

Main Results:

• Neuroscience data analysis container images contained hundreds of vulnerabilities.
• Software updates effectively removed approximately two-thirds of identified vulnerabilities.
• Minifying images by removing unused packages also proved effective in reducing vulnerabilities.

Conclusions:

• Container images for scientific analysis require regular security audits.
• Implementing software updates and image minification are key strategies to mitigate container vulnerabilities.
• Recommendations are provided for building more secure container images.