What the H... is this signing thing about !

While learning container security best practices, we stumble very early during the journey on “signing images”, but what the h… is this signing about? Why should you really care? What are the benefits? Advantages, drawbacks, tools to choose, integration, deployment, day2,… ok ok ok I got it loooonnnggg journey ! Throughout this talk, I aim to explain simply with a little fun what this is all about, why it is so important, and more importantly, how it can help you be better at securing your container-based supply chain and production platform. Plain and simple, you’ll learn from this session whoever you are in your organization C level, leads, experts,… did I hooked you? jump in and sail with me safely the seven container seas

Transcript

1. What the H…. is this signing thing about ? Rachid Zarouali / sevensphere snykcon2021
2. Who am I Rachid Zarouali Freelance Cloud Architect @sevensphere Microsoft Azure MVP / Docker Captain Twitter: @xinity / @sevensphereio email: rachid@sevensphere.io website: https://sevensphere.io 2
3. What do I do Fields of Expertise: Cloud Architecture CI / CD Monitoring / Observability Security Container Automation (IaC) 3 Technology: Azure / GCP / Aws Gitlab / Azure Devops / Drone Grafana Stack / Instana OpenPolicy / Snyk K8S / Nomad Terraform / Ansible Community : Organizer: DockerLyon / CNCFLyon / Container Garage series Speaker: devopsrex / devoxxma / Cloud Native Universe Workshop organizer: Container / IaC / Security
4. Context - docker image are immutable layer cake based package - each layer contains binary, conf, librairies, .... - simple workflow : - app src ==> write Dockerfile ==> Build ==> push ==> deploy Question: how about security ? 4
5. Context: Docker 101
9. issues part I: image immutability ➔ images tags : ◆ human readable aliases ◆ can be easily overridden ➔ image immutability isn't define by tag but image ID ONLY ◆ good : sha256:dcaaa9225b8ab348c5f3c1730ebb1704e70267f8d16d197bf857210c219d40fd ◆ hacked: sha256:b6a123c40b382cad8a4b15937e12758a1b3971d07ecf2801ddf3e47819d64839 ➔ IDs are immutable while Tags moves (i.e Image rebuild and updates)
10. issues part II: common questions ➔ Who build this application image and from where ? ➔ How can I make sure my application image hasn't been "hacked" ? ➔ How can I avoid unwanted applications running in my cluster ? ➔ HOW TO TRACE AND SECURE MY APPLICATION IMAGES ???
11. Image signing to the rescue ➔ Cryptographic mechanism using gpg / TLS certs / .... ◆ Not just the image artefact only but the whole content ◆ Helps • identifying signer • detecting unwanted image alteration • protecting from MITM / replay attack caveat: ➔ signing is not vulnerability scanning ◆ you can have signed AND vulnerable images in production
12. how does it work: Notary ➔ Notary: Default signing framework available in most OCI registries (hub, quay, acr, gcr, harbor ...) ➔ Based on TUF ( https://theupdateframework.com/) ◆ Uses cryptographic signature ◆ Available through the docker CLI using : Docker Content Trust export DOCKER_CONTENT_TRUST=1
13. how does it work: Notary demo
17. how about kubernetes then ? ➔ Admission controller can be used to check : ◆ Image signature / registry source / signer : • IBM potieris: https://github.com/IBM/portieris (doesn’t work with hub, harbor) • sighupio opa-notary-connector: https://github.com/sighupio/opa-notary-connector • Connaisseur: https://github.com/sse-secure-systems/connaisseur Bonus points: ◆ Image vulnerability: • Snyk container admission controller : https://docs.snyk.io/snyk-container/image-scanning-library/kubernet es-workload-and-image-scanning/kubernetes-integration-overview
18. how about kubernetes then ? ➔ Connaisseur: ◆ A Kubernetes admission controller to integrate container image signature verification and trust pinning into a cluster. ◆ support the following signing solutions: • Notary (V1) / Docker Content Trust • sigstore / Cosign • Notary V2 (PLANNED) ◆ additional features: • Detection Mode: warn but do not block invalid images • Namespaced Validation: restrict validation to dedicated namespaces • Alerting: send alerts based on verification result
19. how about kubernetes then ? connaisseur demo
21. In a nutshell ➔ Docker Image ARE immutable (ID not TAGS) ➔ Image signing helps rising your image security ◆ protects from tampering / MITM / replay attack ◆ Used in Kubernetes with an admission controller to better control apps running in your production cluster ➔ signature and validation mechanism are fairly easy to implement You better not: ➔ share your root signing key (only pub key can be shared) ◆ don’t loose it either ➔ Use un-signed images in production
22. twitter: @xinity / @sevensphereio website: https://sevensphere.io Question ?
23. Who am I Rachid Zarouali Freelance Cloud Architect @sevensphere Microsoft Azure MVP / Docker Captain Twitter: @xinity / @sevensphereio email: rachid@sevensphere.io website: https://sevensphere.io 23
24. twitter: @xinity / @sevensphereio website: https://sevensphere.io Thank you all for your participation