If it's in a container its secure right ?

In the talk we will look at the different layers of security that can be applied to a container eco system and the different teams responsibility in the eco system to deliver security.

From the sysadmins point of view how do i make sure the container daemon is secured, what official hardening guides are out there to follow. From an application developers point of view, how does secomp/appapparmor work? To make sure that only the process from the application have access to the host machine. Now that we have the local container secured, how do we make sure our deployments follow the same structure and security profiles. Can we add security checks to our container CD pipeline like we would quality gates? Lastly we will look at from the point of the security team. How can they have input to all the steps we have taken from beginning of the process and not the end. Allowing all the teams to work together breaking down silo to deliver a solution.

Transcript

1. If it’s in a container it’s secure right ? A guide to container security by @scottcoulton
2. About me. Platform engineering lead @
3. Does the traditional infosec toolchain work efficiently in a world where a container’s average lifespan is 2 days?
4. 1. Intro What we will cover ➔ How is container security different ? Does traditional security fit ? ➔ How to protect our container Protecting from the inside out ➔ Security and CD Can the 2 worlds live together ➔ Live demo
5. The way that traditional infosec works is Reactive Containers allow you to be Proactive in your approach to infosec
6. 2. Examples Here are a few comparable examples: ➔ Traditional Nessus, AV, HIDS ➔ New school AppArmor, Clair, Notary
7. The risks. • DoS the host (CPU, Memory or Disk) • Fork Bomb • Kernel modification • Privilege Escalation
8. Let’s look @ protecting the engine. Docker 1.12 Benchmark
9. Some sane defaults. • Don’t run --pid host or --net host (without knowing the risks) • Don’t bind your daemon to tcp://0.0.0.0:4243 • Don’t use aufs as your storage driver • Use TLS for all daemon traffic
10. Just one! That’s all you need. (I am talking about process inside your container !!!)
11. If you know the process then apply AppArmor.
12. AppArmor example.
13. Infosec and continuous delivery. The myth ...
14. Add security to the pipeline Enter
15. Sign our images with Notary.
16. The full continuous delivery pipeline.
17. 3. Live Demo We are going to test what we have learnt today and run a standard Nginx image We will them use the Dirtyc0w vulnerability to write to a file owned by root, then privilege escalate to root for a standard user : ➔ Without AppArmor All exploits will work ➔ With AppArmor Our container will be safe
18. The code from the live demo is available @ https://github.com /scotty-c
19. Any Questions ?