Container Security

Why is Container Security Important? 

Container security is important because of the technology’s operational complexities within cloud workload environments. Security is also important because containers are the foundation upon which so many of today’s public-internet facing applications are built; this leaves them exposed to many potential risks. Those risks associated with containerizing digital assets are manageable and can be mitigated by:

• Shifting left: To clear up any communication or “friction” issues between teams, it’s important that security be brought into the process at the earliest build stages to help catch any flaws or misconfigurations before they affect the end product.
• Securing containers from build to runtime: Container security doesn’t end with deployment. Monitoring container running containers in production is critical due to their ephemeral nature. A security solution that can provide continuous visibility and assessment of containers at runtime is critical for identifying risks and threats in your container environments.
• Leveraging the right tools: What is the right mix for integrating continuous security and monitoring into container environments? As mentioned above, communication with developers’ plans and schedules can help to determine where and at what cadence security should integrate into the containerized build process. This is especially critical when looking at the security and tooling cloud vendors provide vs the suite of tools and solutions an internal team can bring to the process, and how these two layers of security can work harmoniously.

Container Security Best Practices 

Now that we know a bit more about container operations and why they’re so popular these days, let’s take a look at how teams might go about putting in place some best practices for securing those environments.

Secure at runtime 

It's important to implement security not just for steady-state containers and scanning images, but also during runtime when containers are operational. Issues can and should be fixed post-deployment, as security is a continuous process that cannot be fully assured in development.

Regularly scan base or "golden" images 

Vulnerabilities can pop up at any time – or could have been lying in wait to be discovered for months – in a CI/CD environment. When deployments and updates go out on the regular, it’s critical for a security team to be able to spot each and every vulnerability they can. Regular scanning to identify vulnerabilities is imperative to a container security program. Container image scanning will typically reference a vulnerability-and-exploit database containing a list of publicly known vulnerabilities.

Secure your code and its dependencies 

Infrastructure is becoming more compartmentalized, more ephemeral, and more dependent on code as opposed to physical machines. That’s why monitoring containers for vulnerabilities plays such a critical role in system health. Even if everything tests and passes, issues can still come up when conducting post-deployment testing. That’s why it’s so imperative to use a solution that features a consistent set of security checks throughout the CI/CD pipeline. This enables teams to correct misconfigurations and policy violations without delaying deployment.

Establish guardrails for container orchestration 

Deciding to launch operations into the virtual world is a turning point in a DevOps organization, and there are many benefits of containers. If a business is going to invest in that infrastructure, it’s a good idea to secure it all the way up to the application layer and set standards for how containers will be provisioned. Monitoring and tracking critical container events in real time can help to optimize application performance. To top off the process, it’s a good best practice to leverage real time performance monitoring and analytics – such as CPU, memory, and network usage – for all running containers.

Include containers in your broader IAM strategy

Like other cloud resources, containers and the processes that run within them are assigned roles/permissions that need to be tracked and managed with an identity and access management (IAM) plan, preferably in accordance with least privilege access (LPA). After a DevSecOps organization has calibrated a fancy, new multi-cloud container environment, access should be restricted to only those who need it. IAM is key to making cloud and container services secure and compliant. It can also help to institute a rational and sustainable approach for addressing perimeter fluidity and the substantial challenges of governing cloud environments at scale.

Common Cloud Container Platforms

Customers have their choice of vendors when shopping for cloud service providers (CSPs), and there are a variety of different container runtimes and container orchestration platforms to choose from. But it's important to choose one that is properly supported by your underlying cloud platform, while taking into account CSPs have multiple offerings for managing containers.

Docker Engine 

Docker first came onto the market in 2013, and provides the ability to package and run an application in a container. The platform enables sharing of containers while a user works, and ensures that everyone is seeing and working with the same container and functionality. It helps manage container lifecycle through development, distribution, testing, and deployment.

Kubernetes

Kubernetes is an open-source, container-orchestration platform for managing workloads and services. Kubernetes takes charge of container deployment and also manages the software-defined networking layer that allows containers to speak to one another. The platform is portable and facilitates declarative configuration and automation. Google open-sourced the Kubernetes project in 2014.

Google Kubernetes Engine

Google Kubernetes Engine (GKE) was launched in 2018 and is a cluster manager and orchestration system that runs Docker containers. It works with on-prem, hybrid, or public-cloud infrastructure, and can manage container clusters of virtual machines to deploy quickly. GKE can schedule declared containers as declared and actively manage applications.

Amazon Elastic Container Service

Amazon Elastic Container Service (ECS) was launched in 2014, and is designed to integrate with the rest of the AWS platform to run container workloads in the cloud and on-prem. ECS provides consistent tooling, management, workload scheduling, and monitoring across environments. Users can also automatically scale apps across Availability Zones, as well as place containers at will, depending on their resource needs and availability.

Common Container Security Challenges 

We’ve touched on it a bit, but these cloud container environments can be complex behind the scenes. Ease-of-use has been so prioritized by providers in recent years, that most of the complexity is indeed relegated to the background. That doesn’t mean, however, that users need not be aware of the challenges of securing these environments. In other words, you have to know how it works to know how to fix it. Let’s take a look at some common container security challenges.

• Lack of scanning maturity: In a recent SANS Institute survey, it was determined that, while security teams are making great strides in implementing strong vulnerability management (VM) processes in their on-premise environments, the complexity of modern cloud and containerized environments continues to lag behind. This is, of course, due in part to the fact that traditional VM tools have become ubiquitous, unlike solutions that are purpose-built to handle dynamic cloud environments. This is, in part, due to organizations relying on traditional scan technologies they may already have been running, as opposed to a more dynamic solution capable of scanning across a distributed network.
• Ease of expansion: The ephemeral, vastly distributed nature of container-enabled microservices can lead to an exponentially growing environment that can be challenging to keep up with. This is further compounded by the democratization of cloud, which leads to more and more folks across the organization possessing the ability to provision resources in a self-service manner. This makes it difficult to know where to look when troubleshooting, and to know who “owns” a vulnerable resource and who can fix the problem. Remember, cloud and container platforms enable rapid growth and security must keep pace to avoid losing any semblance of control.
• Talent and culture: It may simply be very difficult to find the right talent with the specific skill sets needed to properly – and continuously – ensure the ephemeral risks of containers are mitigated. A security team may not be intricately familiar with modern cloud architectures built on microservices and containers. This is common even among extremely talented engineers because these technologies are so nascent. A managed services solution could help a security operations center (SOC) address many of these headaches.

Read More About Container Security

Container Security: Latest News from the Blog