5 Ways to Secure Your Containers for Docker and Beyond
1 like1,236 views
Presented by Tim Mackey, Senior Technology Evangelist, Black Duck Software on August 17. To use containers safely, you need to be aware of potential security issues and the tools you need for securing container-based systems. Secure production use of containers requires an understanding of how attackers might seek to compromise the container, and what you should be aware of to minimize that potential risk. Tim Mackey, Senior Technical Evangelist at Black Duck Software, provides guidance for developing container security policies and procedures around threats such as: 1. Network security 2. Access control 3. Tamper management and trust 4. Denial of service and SLAs 5. Vulnerabilities Register today to learn about the biggest security challenges you face when deploying containers, and how you can effectively deal with those threats. Watch the webinar on BrightTalk: http://bit.ly/2bpdswg
![Free Tools to Help
Free Docker Container Security Scanner
• https://info.blackducksoftware.com/Security-Scan.html
14 Day Free Trial to Black Duck Hub
• https://info.blackducksoftware.com/Demo.html
• Red Hat Atomic Host Integration (Requires Black Duck Hub)
• atomic scan --scanner blackduck [container]](https://image.slidesharecdn.com/5waystosecureyourcontainersfordockerandbeyond-160818144329/85/5-Ways-to-Secure-Your-Containers-for-Docker-and-Beyond-31-320.jpg)
Ad
More Related Content
What's hot (20)
Viewers also liked (11)
Ad
Similar to 5 Ways to Secure Your Containers for Docker and Beyond (20)
Ad
More from Black Duck by Synopsys (20)
Recently uploaded (20)
5 Ways to Secure Your Containers for Docker and Beyond
- 1. 5 Ways to Secure Your Containers for Docker and Beyond
- 2. 7 of the top 10 Software Companies (44 of the top 100) 6 of the top 8 Mobile Handset Vendors 6 of the top 10 Investment Banks 24 Countries 250+ Employees 1,800Customers Who is Black Duck Software? 27Founded 2002
- 4. Docker 1.10 and and later Level Set: What is a Container? Linux Containers Docker 1.10 and prior Linux kernel namespaces cgroups SELinux/AppArmor liblxc Linux kernel namespaces cgroups SELinux/AppArmor Docker libcontainer Container Container Container Container Container Container Docker Engine runC containerd runC runC containerd-shim containerd-shim containerd-shim
- 5. Container Use Cases Application containers • Hold a single application • Can follow micro-services design pattern • Starting point for most container usage • Short lifespan, many per host System containers • Proxy for a VM • Insulate against core operating system • Perfect for legacy apps • Long lifespan, few per host MySQL Tomcat nginx Kernel MySQL Tomcat nginx Kernel
- 6. Are Containers Production Ready?
- 10. #1 – Trust Your Container Source Atomic Host AtomicApp AtomicApp AtomicNulecule AtomicNulecule RedHat Registry MySQL Redis Jenkins Docker Hub DockerContainer DockerContainer DockerContainer DockerContainer DockerContainer Third Party and Custom Problem: Who to trust, and why? • Trusted source? • Unexpected image contents • Locked application layer versions (e.g. no yum update) • Layer dependencies (monolithic vs micro-services) • Validated when?
- 11. DEVELOPER DOWNLOADS OUTSOURCED DEVELOPMENT THIRD PARTY LIBRARIES CODE REUSE APPROVED COMPONENTS COMMERCIAL APPS OPEN SOURCE CODE Remember – Open Source Components are Ubiquitous
- 12. #2 – Determine Who Can Launch A Container Container default is root access • RBAC/ABAC is orchestration specific Docker Datacenter • Universal Control Plane • RBAC – LDAP/AD/local users • Full/Restricted/View/None Kubernetes • Authorization modules • Admission controllers
- 13. #3 – Define Sensible Network Policies • Docker default network is Linux Bridge • Access policy defined in iptables • Based on Docker daemon startup • External communication on by default • -- iptables=off to disable iptables modification • Inter container communication on by default • -- icc=false to disable inter container communication • -- link=CONTAINER_NAME_or_ID:ALIAS with EXPOSE ports from Docker file • All inter-container/cross host communication is external • `docker network` command simplifies aspects of network design • Create user defined networks, including overlay networks • docker network create --driver bridge sql
- 14. Docker Networking - Example Host eth0/10.204.136.1 Containerveth0 Containerveth1 Containerveth2 Containerveth3 Containerveth4 Containerveth5 docker0 NAT/ 172.16.1.0/24 iptables Host docker0 eth0/10.204.136.2 Containerveth0 Containerveth1 Containerveth2 Containerveth3 Containerveth4 Containerveth5 NAT/ 172.16.1.0/24 iptables
- 15. Host Kubernetes Networking - Example Kubernetes Network eth0/10.204.136.20 Pod Container Pause Container Container veth0/10.204.136.21 Pod Container Pause Container Container veth0/10.204.136.22 Host Kubernetes Network eth0/10.204.136.10 Pod Container Pause Container Container veth0/10.204.136.11 PodContainer Pause Container Container veth0/10.204.136.12
- 16. 0 500 1000 1500 2000 2500 3000 3500 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 Open Source Vulnerabilities Reported Per Year BDS-exclusive nvd Reference: Black Duck Software Knowledgebase, NVD #4 – Perform Vulnerability Tracking
- 17. Knowledge is Key. Can You Keep Up? glibc Bug Reported July 2015 Vuln: CVE-2015-7547: glibc getaddrinfo stack- based buffer overflow
- 18. Knowledge is Key. Can You Keep Up? glibc Vuln Introduced May 2008 glibc Bug Reported July 2015 CVE-2015- 7547 CVE Assigned Feb 16-2016 Low Security Risk Vuln: CVE-2015-7547: glibc getaddrinfo stack- based buffer overflow
- 19. Knowledge is Key. Can You Keep Up? glibc Vuln Introduced May 2008 CVE-2015- 7547 CVE Assigned Feb 16-2016 glibc Bug Reported July 2015 National Vulnerability Database Vuln Published Feb 18-2016 Moderate Security Risk Low Security Risk Vuln: CVE-2015-7547: glibc getaddrinfo stack- based buffer overflow
- 20. Knowledge is Key. Can You Keep Up? glibc Vuln Introduced National Vulnerability Database Vuln Published You Find It May 2008 CVE-2015- 7547 CVE Assigned Feb 16-2016 Feb 18-2016 glibc Bug Reported July 2015 Patches Available You Fix It Highest Security Risk Moderate Security Risk Low Security Risk Vuln: CVE-2015-7547: glibc getaddrinfo stack- based buffer overflow
- 21. #5 – Limit the Scope of Compromise • Enable Linux Security Modules • SELinux • --selinux-enabled on Docker engine, --security-opt=“label:profile” • AppArmor • -- security-opt=“apparmor:profile” • Apply Linux kernel security profiles • grsecurity, PaX and seccomp protections for ALSR and RBAC • Adjust privileged kernel capabilities • Reduce capabilities with --cap-drop • Beware –cap-add and –privileged=false, and CAP_SYS_ADMIN • Use a minimal Linux Host OS • Atomic host, CoreOS, RancherOS • Reduce impact of noisy neighbors • Use cgroups to set CPU shares and memory
- 22. Using Black Duck Hub to Simplify Container Security
- 23. Attackers Decide What’s Valuable …
- 24. But security investment is often not aligned with actual risks
- 25. Black Duck Hub Architecture Hub Scan1 File and Directory Signatures2 Open Source Component Identified 3 Hub Web Application Black Duck KnowledgeBase On Premises Black Duck Data Center
- 26. 8,500 WEBSITES 350 BILLION LINES OF CODE 2,400 LICENSE TYPES 1.5 MILLION PROJECTS 76,000 VULNERABILITIES • Largest database of open source project information in the world. • Vulnerabilities coverage extended through partnership with Risk Based Security. • The KnowledgeBase is essential for identifying and solving open source issues. Comprehensive KnowledgeBase
- 27. Hub Provides Easy Methods to Determine Risk Open source license compliance • Ensure project dependencies are understood Use of vulnerable open source components • Is component a fork or dependency? • How is component linked? Operational risk • Can you differentiate between “stable” and “dead”? • Is there a significant change set in your future? • API versioning • Security response process for project
- 29. INVENTORY Open Source Software MAP Known Security Vulnerabilities IDENTIFY License Compliance Risks TRACK Remediation Priorities & Progress ALERT New Vulnerabilities Affecting You INVENTORY Open Source Software MAP Known Security Vulnerabilities IDENTIFY License Compliance Risks TRACK Remediation Priorities & Progress ALERT New Vulnerabilities Affecting You
- 30. We Need Your Help Knowledge is power • Know what’s running and why • Define proactive vulnerability response process • Don’t let technology hype cycle dictate security Invest in defense in depth models • Don’t rely on perimeter security to do heavy lifting • Do look at hypervisor & container trends in security • Make developers and ops teams part of the solution • Do embed security into deployment process Together we can build a more secure data center
- 31. Free Tools to Help Free Docker Container Security Scanner • https://info.blackducksoftware.com/Security-Scan.html 14 Day Free Trial to Black Duck Hub • https://info.blackducksoftware.com/Demo.html • Red Hat Atomic Host Integration (Requires Black Duck Hub) • atomic scan --scanner blackduck [container]
- 32. Recap: Top 5 Ways to Secure Your Production Containers Know the source of your container images Create well defined authorization and authentication model Implement a restrictive network policy Limit scope of compromise in container host Monitor deployments for vulnerability disclosures
- 33. If you have any questions on the content in this presentation Tweet Tim Mackey @TimInTech or Black Duck Software @black_duck_sw, and use the hashtag #5ways in your question. Follow us such that we can use direct messages for detailed discussion. It’s likely we’ll convert the question into a blog post such that everyone benefits from the discussion. Q&A