What is container security?
Container security is a field focused on protecting all aspects of containerized applications from potential risks. container security manages risks throughout the environment, including all aspects of the software supply chain or CI/CD pipeline, infrastructure, and container runtime and life cycle management applications running on containers. When implementing container network security solutions make sure they’re integrated with the underlying container orchestration for context awareness of the application.
Why is container security important?
While containers offer some inherent security advantages, including increased application isolation, containers also expand an organization’s threat landscape. Failing to recognize and plan specific security measures related to containers could increase the security risks for organizations.
The significant increase in container adoption in production environments makes containers a more appealing target for malicious actors. Plus, a single vulnerable or compromised container could potentially become a point of entry into an organization’s broader environment. Along with the rise in east-west traffic traversing the data center and in the cloud, there are few security controls monitoring this predominant source of network traffic. All of this underscores the importance of container security because the traditional network security solutions offer no protection against lateral attacks.
What are the benefits of container security?
Container security has stepped into the spotlight as overall container usage grows. This in and of itself is beneficial, as various stakeholders are acknowledging the importance of app container security and investing in it across their platforms, processes and training. Because container security is concerned with all aspects of securing a containerized app and its infrastructure, this produces one of its overarching benefits: It can become a catalyst and force multiplier for improving IT security overall. By requiring continuous security monitoring across development, test and production environments, also known as DevSecOps, you can improve your overall security—for instance, by introducing automated scanning earlier in your CI/CD pipeline.
How to secure a container
While container security is best thought of as a holistic field, it obviously focuses on the container itself. The National Institute of Standards and Technology published its Application Container Security Guide, which summarizes several fundamental approaches to doing so. Here are three key consideration from NIST’s report:
- Use container-specific host operating systems. NIST recommends using container-specific host OSes, which are built with reduced features, to reduce attack surfaces.
- Segment containers by purpose and risk profile. Although container platforms generally do a good job of isolating containers (among themselves, and from the underlying OS), NIST notes that you can achieve a greater “depth of defense” by grouping containers by their “purpose, sensitivity, and threat posture” and running them on separate host OSes. This follows a general IT security principle of limiting the blast radius of an incident or attack, meaning that the consequences of a breach are confined to as narrow an area as possible.
- Use container-specific vulnerability management and runtime security tools. Traditional vulnerability scanning and management tools often have blind spots when it comes to containers, which can lead to inaccurate reporting that all is well in container images, configuration settings, and the like. Similarly, ensuring security at runtime is a key facet of container deployments and operations. Traditional, perimeter-oriented tools such as intrusion-prevention systems often weren’t built with containers in mind and can’t properly protect them.
NIST also recommends using hardware-based root of trust, such as the Trusted Platform Module (TPM), for another layer of security confidence, as well as building culture and processes (such as DevOps or DevSecOps) suitable for containers and cloud-native development.
What are the essentials of container security?
There are several important pillars of container security:
- Configuration: Many container, orchestration and cloud platforms offer robust security capabilities and controls. However, these need to be correctly set up and then re-tuned over time—they are rarely optimized “out of the box.” This configuration includes critical settings and hardening in areas such as access/privilege, isolation and networking.
- Automation: Because of the highly dynamic and distributed nature of most containerized applications and their underlying infrastructure, security needs such as vulnerability scanning and anomaly detection can become a virtually insurmountable task when done manually. This is why automation is a key feature of many container security features and tools, much in the same way that container orchestration helps automate a lot of the operational overhead involved in running containers at scale.
- Container security solutions: Some teams will add new security tools and support to their mix that are built specifically for containerized environments. Such tools are sometimes focused on different aspects of the cloud-native ecosystem, such as CI tools, container runtime security and Kubernetes.
What are the common container security mistakes to avoid?
There are several common mistakes when it comes to securing containers and environments, including:
- Forgetting basic security hygiene. Containers are a relatively new technology that requires some newer security approaches. But that doesn’t mean abandoning certain security fundamentals For example, keeping your systems patched and updated, whether those are operating systems or container runtimes or other tools, remains an important tactic.
- Failure to configure and harden your tools and environments. Good container and orchestration tools—just like many cloud platforms—come with significant security capabilities. However, to unlock their benefits, you must configure them for your particular environments, rather than running them on default settings. Examples include granting a container only the capabilities or privileges it actually needs to run, to minimize risks such as a privilege escalation attack.
- Ignoring to monitor, log, and test. When teams begin running containers in production, they may lose visibility into their application health and environments if they’re not careful. This is a big risk that some teams fail to recognize, and it’s particularly relevant for highly distributed systems that may run across multiple cloud environments along with on-premises infrastructure. Ensuring that you have proper monitoring, logging and testing in place is key to minimizing unknown vulnerabilities and other blind spots.
- Not securing all phases of the CI/CD pipeline. Another potential shortcoming in your container security strategy is ignoring other elements of your software delivery pipeline. Good teams avoid this with a “shift left” philosophy, meaning you prioritize security as early as possible in your software supply chain and then consistently apply tools and policies throughout.
VMware Container Security related products, solutions, and resources