Practical steps for securing containers

Slide 1

Slide 1 text

Slide 2

Slide 2 text

2 @lizrice | @aquasecteam Bad headlines

Slide 3

Slide 3 text

3 @lizrice | @aquasecteam

Slide 4

Slide 4 text

4 @lizrice | @aquasecteam

Slide 5

Slide 5 text

5 @lizrice | @aquasecteam Observe Code Hosts Test Build Run Pipeline

Slide 6

Slide 6 text

6 @lizrice | @aquasecteam Observe Hosts Build Run Test Code Code quality Security testing Security policies Minimal attack surface Least privilege Defence in depth Principles

Slide 7

Slide 7 text

Observe Code Hosts Test Build Run Code quality Security starts in development

Slide 8

Slide 8 text

8 @lizrice | @aquasecteam

Slide 9

Slide 9 text

9 @lizrice | @aquasecteam

Slide 10

Slide 10 text

10 @lizrice | @aquasecteam

Slide 11

Slide 11 text

11 @lizrice | @aquasecteam Static analysis Code review Code quality

Slide 12

Slide 12 text

Observe Code Hosts Test Build Run Security testing Catch problems early

Slide 13

Slide 13 text

13 @lizrice | @aquasecteam “(83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, . Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage. ” REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT such as encryption GDPR compliance

Slide 14

Slide 14 text

14 @lizrice | @aquasecteam

Slide 15

Slide 15 text

15 @lizrice | @aquasecteam

Slide 16

Slide 16 text

16 @lizrice | @aquasecteam Automated testing is not just for functions Security testing

Slide 17

Slide 17 text

Observe Code Hosts Test Build Run Security policies Always be in compliance

Slide 18

Slide 18 text

18 @lizrice | @aquasecteam 6.1 Ensure that all system components and software are protected from known vulnerabilities by having the latest vendor-supplied installed. Deploy critical patches within a month of release. 6.2 Establish a process to identify and assign a risk ranking to newly discovered security vulnerabilities. Risk rankings should be based on industry best practices and guidelines. Ranking vulnerabilities is a best practice that will become a requirement on July 1, 2012. Payment Card Industry Data Security Standard version 2.0 security patches Ranking vulnerabilities PCI compliance

Slide 19

Slide 19 text

19 @lizrice | @aquasecteam

Slide 20

Slide 20 text

20 @lizrice | @aquasecteam FROM wordpress:demo COPY microscanner /microscanner RUN chmod +x /microscanner ARG token RUN /microscanner --html ${token} > /ms-out.html docker build -f Dockerfile.wp --build-arg=token=$TOKEN . MicroScanner

Slide 21

Slide 21 text

21 @lizrice | @aquasecteam MicroScanner

Slide 22

Slide 22 text

22 @lizrice | @aquasecteam Scanning tools Image admission controls Security policies

Slide 23

Slide 23 text

Observe Code Hosts Test Build Run Host configuration Don’t make it easy for attackers

Slide 24

Slide 24 text

24 @lizrice | @aquasecteam Files directly on host machine(s) Files in container images Host vulnerabilities

Slide 25

Slide 25 text

25 @lizrice | @aquasecteam Host vulnerabilities

Slide 26

Slide 26 text

26 @lizrice | @aquasecteam Host vulnerabilities

Slide 27

Slide 27 text

27 @lizrice | @aquasecteam CIS Docker Benchmark CIS Kubernetes Benchmark Host configuration

Slide 28

Slide 28 text

28 @lizrice | @aquasecteam

Slide 29

Slide 29 text

29 @lizrice | @aquasecteam

Slide 30

Slide 30 text

Observe Code Hosts Test Build Run Least privilege Only give what you need

Slide 31

Slide 31 text

31 @lizrice | @aquasecteam

Slide 32

Slide 32 text

32 @lizrice | @aquasecteam

Slide 33

Slide 33 text

33 @lizrice | @aquasecteam

Slide 34

Slide 34 text

34 @lizrice | @aquasecteam Minimize bind mounts Set USER in Dockerfile Avoid --privileged Least privilege

Slide 35

Slide 35 text

Observe Code Hosts Test Build Run Runtime protection Spot unexpected behaviour

Slide 36

Slide 36 text

36 @lizrice | @aquasecteam

Slide 37

Slide 37 text

37 @lizrice | @aquasecteam

Slide 38

Slide 38 text

38 @lizrice | @aquasecteam

Slide 39

Slide 39 text

39 @lizrice | @aquasecteam Seccomp / AppArmor Commercial tools New runtimes Runtime protection

Slide 40

Slide 40 text

40 @lizrice | @aquasecteam Runtime protection Static analysis Minimal container OS TLS checks Automated scanning Read-only, limit privileges Actions

Slide 41

Slide 41 text

41 @lizrice | @aquasecteam Runtime protection Minimal container OS Automated scanning Read-only, limit privileges TLS checks Static analysis Code quality Security testing Security policies Minimal attack surface Least privilege Defence in depth Principles