Security in the Age of Containers

Brief introduction into container security highlighting some of the best practices for images, hosts and network.

Transcript

1. SECURITY IN THE AGE OF CONTAINERS J o o n a t h a n M ä g i
2. INTRODUCTION Containers are a solution to the problem of how to get software to run reliably when moved from one computing environment to another. This could be from a developer's laptop to a test environments, from a staging into production, or maybe even from a physical data center to public cloud. Container consists of an entire runtime environment: an application, plus all its dependencies, libraries and other binaries, needed to run it, bundled into one package. Container shares the operating system kernel with the other containers.
3. INTRODUCTION Containers provide additional layer of isolation, making your infrastructure safer by default while also making the application lifecycle faster and leaner. Some security benefits of containers include smaller surface area for attacks, shorter lifespan (of particular deployed version) and generally more automated processes around development and deployment. In most cases containers should be considered ephemeral and stateless.
4. INTRODUCTION Containers use several mechanisms for security, for example: § Linux Kernel Namespaces (providing isolation, but can also be shared) § Linux Control Groups (resource limitations) § Linux Capabilities (privileges beyond root/non-root) § Can leverage AppArmor, SELinux etc. Containers are, by default, quite secure. Especially if you take care of running your processes inside the containers as non-privileged user.
5. SECURITY ON HOSTS Follow standard hardening processes, firewall off the host and only allow access via known private network. Limit SSH access to your cluster / nodes. Watch out for privileged containers. If you need to have some privileged containers and you run on Kubernetes use DenyEscalatingExec admission controller to deny exec and attach commands.
6. SECURITY OF IMAGES Where did the image come from, is it the version we wanted and has somebody modified it? § Scan for vulnerabilities (CVE database includes around 90k) using something like Clair. Different researches have shown that around 20% of public images contain significant vulnerabilities. § Depending on your environment you might want to always pull images not to share them with other containers on host § Use ImagePolicyWebhook admission controller on Kubernetes Smaller images usually means less vulnerabilities. Software can’t be vulnerable if it’s not installed. Have any sensitive data been stored in the image?
7. SECURITY OF NETWORK Ensure container can only communicate with whom it must. Running different applications on the same cluster creates a risk of one compromised application attacking a neighboring application. Kubernetes provides NetworkPolicy resource for label based specification of ingress traffic rules for pods / containers. As an alternative or if you require more control look into security capabilities of other overlay network providers like Project Calico. Service meshes like Istio can provide additional layer of security by securing service to service communication by automating key management of mTLS or alike.
8. RESOURCE QUOTAS An option of running resource-unbound containers puts your system in risk of Denial of Service or “noisy neighbor” scenarios. Kubernetes allows to define resource quota policies in order to limit the CPU and memory a pod (container) is allowed to consume.
9. PLAN FOR ATTACKS Think about how you would investigate an potential attack as containers are mostly ephemeral and stateless. Log everything and collect logs to a central location for easy correlation and analysis. Think about how to snapshot problematic containers using filesystem tools or docker commit What do you need to backup and what is your disaster recovery plan?
10. BASIC SECURITY RECAP § Prevent unknown images § Continuously scan images for vulnerabilities § Stop privilege escalation § Enable only Capabilities that are required § Enforce network isolation § Protect host resources § Encrypt sensitive information § Enforce use of automation tools § Provide visibility across environments
11. SOME TOOLS Center for Internet Security has put together benchmarks for Docker and Kubernetes and tools have been built for validating setups against the benchmarks. https://github.com/aquasecurity/kube-bench https://github.com/docker/docker-bench-security
12. THANKS!