More Related Content
What's hot (20)
Similar to DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Container security oct2018 (20)
Recently uploaded (20)
DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Container security oct2018
- 1. ©2017 Lacework, Inc. Confidential and Proprietary. 1 Securing your Containerized workload from Development to Runtime! Meetup: DevSecOps - Secure your Containers Oct 18th 2018
- 2. ©2018 Lacework, Inc. Confidential and Proprietary. Agenda: Secure your Containers 2 ✓ Intro./Activity ✓ Container vs. VM Instance ✓ Anatomy of a Container ✓ Container Attack Surfaces ✓ Container Best Practices ✓ Top Ten Questions ✓ Q & A
- 3. ©2018 Lacework, Inc. Confidential and Proprietary. Feeling Secure 3
- 4. ©2018 Lacework, Inc. Confidential and Proprietary. Trivia 4
- 5. ©2018 Lacework, Inc. Confidential and Proprietary. 5
- 6. ©2018 Lacework, Inc. Confidential and Proprietary. Container: Why is it Important 6
- 7. ©2018 Lacework, Inc. Confidential and Proprietary. Container: World Wide View 7
- 8. ©2018 Lacework, Inc. Confidential and Proprietary. Container: Lightweight VM? ✓ Container Runtime replaces Hypervisor ✓ Not in Kernel ✓ No Boot capability ✓ Control Groups & Resource Isolation ✓ Always in a Container albeit root’s ✓ Management APIs
- 9. ©2018 Lacework, Inc. Confidential and Proprietary. Container: Runtime Engine ✓ LXC ✓ systemd-nspawn (chroot++) ✓ Docker Engine ✓ rkt, runC ✓ OpenVZ ✓ Jails/Zones ✓ They all use the same kernel
- 10. ©2018 Lacework, Inc. Confidential and Proprietary. 10
- 11. ©2018 Lacework, Inc. Confidential and Proprietary. Security: Container Images ✓ Vulnerable Software: Image contains everything but the Linux Kernel — base, runtime and application. Shared responsibility between dev and ops. Responsibility is critical to success bridging the gap between application dependencies and security vulnerabilities. ✓ Image authenticity: Container images are designed to be unchangeable. The best practice for updating an image is to create a new one with the desired changes
- 12. ©2018 Lacework, Inc. Confidential and Proprietary. Security: Runtime Measures ✓ Kernel security: Common Vulnerability Databases (CVDs). Kernel-based vulnerabilities typically are difficult to deal with because of the inherent dependencies on vendor update release cycle and the associated application downtime. ✓ Container runtime compromise: Container runtime is yet another application sanctioned to run in an environment and is subject to similar types of threats and vulnerabilities. ✓ Container escape: Single kernel shared among all the isolated processes, the gatekeeper for all kernel-level system calls. Namespaces simplifies this
- 13. ©2018 Lacework, Inc. Confidential and Proprietary. Security: Runtime Measures ✓ Data exfiltration: Traditionally security posture focuses on the physical perimeter of the network. Weakened with the adoption of microservices and the dynamicity using container orchestration ✓ Resource abuse: Container runtimes have built-in safeguards for the required resources such as CPU, memory and block IO. While deploying containers, one must consider using these guardrails in all instances ✓ Administration of shared secrets: Requirements are to consolidate secret operations— creation, reading, revocation, rotation and auditing under a common head as part of the continuous security model.
- 14. ©2018 Lacework, Inc. Confidential and Proprietary. Container: House of Cards 14 Container Benefits Virtual Machine Benefits Consistent Runtime Environment Application Isolation Run Anywhere Small Size on Disk Low Overhead Dependency
- 15. ©2018 Lacework, Inc. Confidential and Proprietary. • OS • Applications, containers • Kubernetes API • User access & files • Application API • Encryption • Keys and Secrets Workloads & Hosts Container Attack Surface 15 • Static container scanning (services like hub, quay.io) • Image authenticity • Image content with vulnerabilities (CVEs) • Container startup capability • Container misconfiguration • Host based tools are limited • Traditional monitoring tools like osquery, ossec etc don’t work • Linux Kernel is Container blind • Tools like auditd, app armor, SE linux don’t have the context • Container Resource Abuse • Putting hard limits of CPU and Memory are inviting trouble because app profiles are not understood • Container Escape • collision in UID inadvertently grants the process inside container to inherit permissions of the user outside container • Keys and Secrets • Data Exfiltration
- 16. ©2018 Lacework, Inc. Confidential and Proprietary. Container Security DEPLOYMENT MODEL Containers & Properties Network Communication Launch Patterns SOLUTION Files Discover Process in a ContainerContainer in Host
- 17. ©2018 Lacework, Inc. Confidential and Proprietary. What does this mean ✓ Host Security – This is still a shared component ✓ Container Runtime Security – Elasticity makes rules-based approach not feasible. ✓ File Integrity and Vulnerability Analysis – Tampering of configuration and log files is a critical indicator of compromise along with known issues. ✓ Investigations – Containers are short-lived, and any investigation becomes very difficult if data is not collected and correlated in real time.
- 18. ©2018 Lacework, Inc. Confidential and Proprietary. Managing Risk: Know your Enemy First Principles of Container Security ✓ Know contents of your container ✓ Dependencies - Application, Libraries, Configuration ✓ Principle of Least Access – Container-Container, Container-Host ✓ Principle of Isolation – Data Sharing, Client/Server ✓ Protection is key but detection is a must
- 19. ©2018 Lacework, Inc. Confidential and Proprietary. Complete Container Security Solution
- 20. ©2018 Lacework, Inc. Confidential and Proprietary. Security: House of Cards 20 Datacenter Trends Security Challenges Containers, Encryption, Elastic workloads, transient IPs Network is Blind Logs stale, expensive and sampled Low precision alerts and long MTTD No visibility for east-west and application level north-south Insider Threats Dev/Ops responsible for security Lack of Security Skills Scale and velocity Difficult Investigations
- 21. ©2018 Lacework, Inc. Confidential and Proprietary. Lacework Container End-End Security 21
- 22. ©2018 Lacework, Inc. Confidential and Proprietary. Lacework Container End-End Security 22 Container Security ✓ Automated 24x7 monitoring ✓ Host IDS for security & compliance ✓ Behavior - Process, User, Network ✓ File Integrity Monitoring (FIM) ✓ Visibility & Investigations ✓ End-to-end visibility at all layer ✓ Orchestrator APIs
- 23. ©2018 Lacework, Inc. Confidential and Proprietary. Top 10 Questions 23 ✓ How do I assess container risk? ✓ Application hardened by static analysis for years, Do I need to address anything? ✓ Development team is all about speed with release to production each week. How does security fit in the frame? ✓ Provider offers Containers-aaS(PaaS). Do I need additional container security tools? ✓ Containers have more than just code - keys, certificates, passwords and other sensitive information. Is there a way to protect them? ✓ Orchestrators like Kubernetes has a lot of security built in Network isolation, IAM, Secrets Management, proxy services and so on. Why focus on the containers?
- 24. ©2018 Lacework, Inc. Confidential and Proprietary. What does it mean? What Infrastructure Provider does for you What you have to do yourself Application to Secure
- 25. ©2018 Lacework, Inc. Confidential and Proprietary. About: Rakesh Sachdeva 25 ✓ Lacework Founded in 2014 ✓ Founding Engineer at Lacework ✓ Passionate about Security ✓ Thought Leader in Infrastructure development ✓ @raksac ✓ rakesh-sachdeva-raksac
- 26. ©2018 Lacework, Inc. Confidential and Proprietary. Questions and Answers?