Overview of NeuVector
Introduction to Background
With the rapid development and innovation of cloud-native technology, enterprises are accelerating their digital transformation, but also facing new security risks involving container networks, component orchestration, images, image repositories, container runtimes, and more.
Enterprises leveraging cloud-native for digital transformation, while taking advantage of agility, efficiency, and scalability, must also face many security risks and challenges.
To avoid security issues affecting the agility and technological innovation of enterprise users when developing business applications, this platform has created a product called NeuVector in conjunction with NeuVector, which can help users effectively prevent and resist container security risks, and quickly detect and respond to security issues.
Introduction to NeuVector
NeuVector is an end-to-end open-source container security platform that provides enterprise-level zero-trust security solutions for containerized computing components. It can help enterprises strengthen security protection for any environment, resist increasingly powerful security threats, and avoid affecting developer agility and technological innovation.
Introduction to Core Functions
NeuVector provides a powerful end-to-end container security platform. It provides end-to-end vulnerability scanning and complete runtime protection mechanisms for containers, Pods, and nodes, including:
-
CI/CD vulnerability management and admission control. Use Jenkins plugins to scan images, scan artifact repositories, and perform admission control on deployments entering production.
-
Compliance protection. NeuVector detects violations of normal behavior based on created whitelist policies.
-
Threat detection. NeuVector detects common application attacks such as DDoS and DNS attacks against containers.
-
DLP and WAF sensors. NeuVector checks network traffic to prevent sensitive data loss and detect common OWASP Top10 WAF attacks.
| Component Name (CN/EN) | Function Description |
|---|---|
| Controllers | Controllers are responsible for managing and monitoring the entire NeuVector system. |
| Enforcers | Enforcers are deployed on each node and are responsible for monitoring and protecting containers. |
| Managers | Managers provide a web interface and API interface for managing and configuring the NeuVector system. |
| Scanners | Scanners are used to scan container images and runtime environments to detect vulnerabilities and security risks. |
| Controller | - Manages the Enforcer cluster. - Provides REST API for the management console. |
| Enforcers | Enforce security policies. |
| Manager | Provides a web UI. |
| Scanner | - Scans for vulnerabilities in images, containers, and nodes. - Scans for compliance in images, containers, and nodes. - Includes CVE vulnerability database. |
Architecture
The architecture of NeuVector is shown in the following diagram.
Tip: The Scanner can run as a standalone pipeline scanner and is not shown as a separate component in the architecture diagram.
