Double Down on Your Cloud Security Posture

Securing Containerized Services

Containers are increasingly becoming an important part of enterprise applications. They help to build immutable infrastructures. Immutability makes it difficult for attack vectors to access a container and modify it in such a way that a backdoor is created. Immutability also makes updating a container easy. In case a security vulnerability is identified in one container, it can be replaced and the threat can be limited to that container.

Containers have only a minimum number of software components, which reduces the surface area of attack. Also, the entry and exit points of each container are defined clearly. By following the principle of least privilege, a container’s access to various resources can be limited to those necessary for it to function.

But container security is only as good as the security practices that are followed:

Container running as root: A container running as the root user is as insecure as any application with root privilege. Container technology does not create a trust boundary. Organizations need to be aware of this when they deploy containerized applications. The practice of running containers with specific users and groups in the system should be followed.

Image provenance: Any application is only as secure as the image on top of which it is built. Image identification and trust mechanisms are important to secure container-based infrastructure. Having a private authenticated repository that makes use of certificates and digital signatures helps. Repository of trusted images are kept encrypted and audit is held on the repository to ensure compliance with security processes.

Security testing: Any image should also undergo security testing before being deployed to the environment. Ideally, the security tests should be a part of the CI/CD pipeline, and run similar to how unit tests do. Only if the built image passes the security tests should the pipeline deploy the container to your stack.

Mandatory Access Control as Defense

Constraining an application’s ability to access or perform an operation on other resources such as a network port or file devices can be constrained through mandatory access control. In the context of containers, access control limits a container’s ability to affect the host or other containers.

Devising appropriate policies with any of the two MAC systems SELinux or AppArmor helps contain an attack even when the attacker is able to exploit the service provided by one of the containers. Depending on the level of security and flexibility needed, we help you choose the appropriate MAC tool. Linux kernel can also be used to restrict container applications in the place of MAC.

Securing the Boundary

Firewalls provide the first level of security to all Internet-connected applications and services. With the advent of cloud infrastructure, additional security hardening mechanisms like Virtual Private Cloud (VPC) are available. VPCs allow you to create a set of computing resources connected through Virtual Private Networks with only certain nodes exposed to the Internet. Network rules can be created between these nodes to prevent a breach. Quite often, the focus is on network access from the outside. It is equally important and useful to restrict outgoing traffic from each computing resource. Systematic isolation can be achieved by creating subnets in VPCs.

Securing Container Runtime and Platform

In the case of virtual machines and containers, the security of the host is also a concern. Vulnerabilities in the host platform or runtime can lead to breach across containers.

Using fully loaded systems can increase the attack surface in both cases. The isolation that virtual machines or containers provide is not on par with bare metal servers. Technologies like gVisor from Google provide an additional layer of security. All of this points to the need to devise your security strategy carefully.