What is Container Security?

Container security refers to the set of tools and security processes used to secure container workloads. This includes securing images used in containers, the container itself and container orchestration platforms such as Kubernetes, AWS ECS and Red Hat OpenShift Container Platform. Although containers incorporate certain protective features, they remain vulnerable to attack. Other aspects of container security to consider include building secure containers and establishing a protected runtime environment. Apart from actively securing containers, it is important to adopt robust backup and recovery processes for Kubernetes and other container services.

Containers

A container is a standard unit of software that packages up code and all its dependencies, so the application runs quickly and reliably from one computing environment to another. Containers share the machine’s OS system kernel and therefore do not require an OS per application, driving higher server efficiencies and reducing server and licensing costs. Developers use this ability to run microservices and other applications inside the walls of a virtual container, isolated from other applications on a server or computer. Unlike virtual machines (VM), containers are portable and can run in any environment that has a daemon service that supports the type of container. While Docker is the most popular container technology, numerous other types exist, including the original LXC Linux container.

Orchestration Platforms

Although containers can run independently, it is more common to use specific software platforms to manage and configure containers, especially if working with multiple containers. Common examples of these platforms include Kubernetes, AWS Elastic Container Service and Docker Swarm.

Why is Container Security Important?

Although containers isolate applications and incorporate a degree of security, they are still vulnerable to cybersecurity attacks. Points of entry include compromised images, weak access control and poor isolation between containers and host software. Another common way for hackers to access containers is through corrupted third-party images used as container building blocks. A container image is a static executable file containing libraries, tools and software required to create a container and is often composed of multiple layers on top of a base image. A hacked image used in multiple containers could cause serious damage.

Another factor is where and how the container stores its data. Initially, containers were stateless, running without storing state data and leaving no trace when closed. The host operating system stored persistent data. But as developers use containers to compartmentalize legacy and other applications not written for containerization, there is a need to store state data (statefulness). While Docker, Kubernetes and other companies provide ways to manage stateful containers, it is crucial to provide ways to recover stateful containers after a system failure by using continual backups.

Container Security Components

Container security can be broken up into several components, including development, build environment, runtime environment and orchestration.

Development of Containers

You should take great care to verify that software and images used in container development are well-written and don't contain vulnerabilities, configuration defects or malware. Image registries must be secure and only hold trusted images. Always use container scanning tools to check for vulnerabilities and avoid storing stale or out-of-date images.

Container Build Environment

The build environment must be totally secure. Developers should use automated tools to verify components used and preferably adopt automated CI/CD pipelines that minimize the risk and increase visibility.

Runtime Environment

The runtime environment must be properly secured with rigorous access control protocols. The use of automated security policies to check for violations and vulnerabilities can help minimize security risks. Containers themselves should be executed with the minimal number of permissions required, reducing opportunity for an attacker to leverage a container with elevated privileges to get host control.

Orchestration and Infrastructure

Orchestrating containers at scale using platforms such as Kubernetes are challenging. It is crucial to make certain the host OS is secure, and to always follow best practices using tools provided by the orchestration platform. Similarly, ensure the server and network infrastructure is secure.

Benefits of Container Security

The benefits of good container security extend across all aspects of container development and deployment. Effective container security reduces risk by minimizing the attack surfaces. It improves transparency, increases pipeline integrity and improves system security and administration.

Reduces Attack Surface

Good container security policies reduce the attack surface. These policies limit potential access points by keeping interfaces simple and small. Least privilege policies that restrict access limit the potential for security breaches, and each container has its unique security boundary.

Enhances Transparency

The relative simplicity of containers allows users to analyze and check container contents, especially compared to virtual machines. Image scanning and the use of trusted images help ensure that images are clean.

Builds Pipeline Integrity

Strong CI/CD pipeline controls prevent hackers from accessing registries, workstations and build servers. These should be supported by regular audits and automated vulnerability scanning. Administrators should limit access to that which is sufficient to allow users to complete their tasks.

Improves Overall Security

The emphasis on protecting containers and their supporting infrastructure acts as a catalyst for overall IT security improvements. Examples include runtime and vulnerability detection tools specifically configured for containers. These, together with standard intrusion-detection software and other tools, lead to an overall improvement in security.

Simplifies Administration

Effective container security means it is easier to manage containers. Developers have fewer concerns when scaling container applications. Another benefit of good container security is a reduction in the time and effort required to manage containerized environments.

How to Secure a Container

Securing containers is a multistep process that includes securing the container image, protecting the network environment and securing the build pipeline. Other aspects to consider include protecting cloud-based databases and adopting container backup strategies.

Verify Container Images

Carefully select container images, particularly base images, from reputable sources and registries. Ensure you can access the component source code. Even then, it is best to thoroughly test these images to find vulnerabilities. The same concept applies when adding applications or changing configurations.

Secure the Container Host Infrastructure

Always use a container host operating system that offers a high degree of container isolation. Review default configurations to eliminate points of attack, such as activating the access control features of Kubernetes. Use third-party security monitoring tools to monitor the host environment.

Secure the Container Networking Environment

Use web filtering and intrusion-prevention systems to identify and stop malicious attacks and content from the internet. Only open ports required by the application and use transport layer security (TLS) to encrypt data. Internally monitor network traffic between containers to detect unusual activity that may signify that an attacker has gained a foothold. Only allow connectivity between containers when it is absolutely necessary.

Lock Down the Management Stack

Carefully control permissions on your container host platform. Activate platform features that enhance network security, such as restricting traffic between Kubernetes Pods. Use a separate, hardened registry to improve registry security and protect it from attack.

Automate and Secure CI/CD Pipeline Deployment

Secure your build server, workstations and code repository to prevent attackers from gaining a foothold in the delivery pipeline. Use least-privilege access control policies and audit them regularly. Automate pipeline deployment and use vulnerability scanning to flag security issues.

Adopt Robust Container Backup Strategies

Continuously back up your containers and data, and regularly test your ability to restore workloads. Be aware that very few containers are genuinely stateless, so ensure your backup policies include container backups and database components. Clarify who is responsible for container backup strategies.

Best Practices for Container Security

The huge growth in container adoption, particularly in the cloud, means there is a significant increase in cybersecurity risk. To minimize this risk, it is essential to implement best practices for container security, including:

• Use trusted images. Scan all images for vulnerabilities; only source images from trusted sources and always check image provenance.
• Use thin, short-lived containers. Enhance container security by keeping the number of files to a minimum, restricting their lifetime to as short a period as possible and replacing containers regularly.
• Create a secure runtime environment. Maintain a secure environment by running containers on a secure platform, activating platform security features and protocols and operating a secure registry.
• Adopt robust access control. Limit container access to computing resources to what is required, use role-based user access control and restrict administrator access to only creating infrastructure.
• Don't mix container applications. Keep mission-critical applications separate from container hosts and group containers according to their function and purpose on separate hosts to minimize collateral damage in case of a security breach.
• Adopt continuous monitoring. Use continuous monitoring applications such as a runtime application self-protection (RASP) control and container runtime and vulnerability tools.

How to Get Started With Veeam

The rapid growth in container applications greatly increases potential cyberattack vulnerabilities. Bear in mind that containers represent a major infrastructural change and that conventional security solutions may not provide adequate protection. So, it is crucial to invest in security solutions and best practices aimed at enhancing container security. Also, you should always use backup software intended specifically for container infrastructure. Veeam offers several purpose-built, easy-to-use data management platforms that include features such as:

• Flexible back and restore features
• Disaster recovery capabilities
• Easy scalability
• Cloud and on-premises capabilities

They include Veeam Kasten for Kubernetes, which is a Kubernetes-native solution for backup, disaster recovery and the enablement of application mobility across different Kubernetes clusters, infrastructure and distributions.