What is Container Security?

While container security is best thought of as a holistic field, it obviously focuses on the container itself. The National Institute of Standards and Technology published its Application Container Security Guide, which summarizes several fundamental approaches to doing so. Here are three key consideration from NIST’s report:

1. Use container-specific host operating systems. NIST recommends using container-specific host OSes, which are built with reduced features, to reduce attack surfaces.
2. Segment containers by purpose and risk profile. Although container platforms generally do a good job of isolating containers (among themselves, and from the underlying OS), NIST notes that you can achieve a greater “depth of defense” by grouping containers by their “purpose, sensitivity, and threat posture” and running them on separate host OSes. This follows a general IT security principle of limiting the blast radius of an incident or attack, meaning that the consequences of a breach are confined to as narrow an area as possible.
3. Use container-specific vulnerability management and runtime security tools. Traditional vulnerability scanning and management tools often have blind spots when it comes to containers, which can lead to inaccurate reporting that all is well in container images, configuration settings, and the like. Similarly, ensuring security at runtime is a key facet of container deployments and operations. Traditional, perimeter-oriented tools such as intrusion-prevention systems often weren’t built with containers in mind and can’t properly protect them.
   

NIST also recommends using hardware-based root of trust, such as the Trusted Platform Module (TPM), for another layer of security confidence, as well as building culture and processes (such as DevOps or DevSecOps) suitable for containers and cloud-native development.

There are several important pillars of container security:

• Configuration: Many container, orchestration and cloud platforms offer robust security capabilities and controls. However, these need to be correctly set up and then re-tuned over time—they are rarely optimized “out of the box.” This configuration includes critical settings and hardening in areas such as access/privilege, isolation and networking.
• Automation: Because of the highly dynamic and distributed nature of most containerized applications and their underlying infrastructure, security needs such as vulnerability scanning and anomaly detection can become a virtually insurmountable task when done manually. This is why automation is a key feature of many container security features and tools, much in the same way that container orchestration helps automate a lot of the operational overhead involved in running containers at scale.
• Container security solutions: Some teams will add new security tools and support to their mix that are built specifically for containerized environments. Such tools are sometimes focused on different aspects of the cloud-native ecosystem, such as CI tools, container runtime security and Kubernetes.

There are several common mistakes when it comes to securing containers and environments, including:

• Forgetting basic security hygiene. Containers are a relatively new technology that requires some newer security approaches. But that doesn’t mean abandoning certain security fundamentals For example, keeping your systems patched and updated, whether those are operating systems or container runtimes or other tools, remains an important tactic.
• Failure to configure and harden your tools and environments. Good container and orchestration tools—just like many cloud platforms—come with significant security capabilities. However, to unlock their benefits, you must configure them for your particular environments, rather than running them on default settings. Examples include granting a container only the capabilities or privileges it actually needs to run, to minimize risks such as a privilege escalation attack. 
• Ignoring to monitor, log, and test. When teams begin running containers in production, they may lose visibility into their application health and environments if they’re not careful. This is a big risk that some teams fail to recognize, and it’s particularly relevant for highly distributed systems that may run across multiple cloud environments along with on-premises infrastructure. Ensuring that you have proper monitoring, logging and testing in place is key to minimizing unknown vulnerabilities and other blind spots.
• Not securing all phases of the CI/CD pipeline. Another potential shortcoming in your container security strategy is ignoring other elements of your software delivery pipeline. Good teams avoid this with a “shift left” philosophy, meaning you prioritize security as early as possible in your software supply chain and then consistently apply tools and policies throughout.