Container Security: Four Key Areas Every Organization Should Protect
Awareness of the risks, general cybersecurity principles, and specific security measures can help protect data and processes.
Many companies now use containers they have developed themselves or obtained from cloud service providers to implement applications and processes in an agile, fast, and flexible manner. However, containers are executable applications and can introduce security risks. In addition, the servers that host the containers and the registries extend the IT attack surface. Organisations should therefore not overlook these additional security risks.
To understand and manage the additional risks posed by containers, you first need to know the basics of container technology. People do not always understand these concepts well. So what is a container, or rather, how is it built? Every developer, whether in the company or at the service provider, selects the images needed for a container’s functionality from a central registry and bundles them into an application that should ideally be as lean as possible.
These registries, which provide the building blocks for containers, are either public or proprietary to the company or cloud service provider. To improve resilience in the event of a container failure, developers redundantly combine containers into clusters. Another container can take over if one container fails. These clusters are orchestrated, automated, and managed via platforms such as Kubernetes.
Four Key Areas of Container Security
Risk Factor: Portability
Containers can be moved between environments and used wherever they are needed. This portability is a cornerstone of agile processes and applications and a decisive argument for using containers. At the same time, this portability is also a risk factor. If an image from a registry contains a vulnerability, that image can also be distributed across multiple environments.
Taking into account the structure and use of containers, there are four areas of container security:
- the registry from which a user obtains the images for the container;
- the container runtime;
- the container host; and
- the level of container orchestration.
Attackers may find ways to gain access. After gaining an initial foothold in the network, they may reach other systems through lateral movement. Once there, they may compromise the registry, the container host with its images, or the clusters with multiple redundant containers. They may also repurpose legitimate images for malicious purposes. However, attacks can also target computing resources, which attackers may attempt to use for activities such as crypto mining or other unauthorised services.
IT security officers should protect the four areas of container security using the following methods:
1. Securing Container Images and Registries
When using images, as with software, caution is required, regardless of whether they come from a public or private registry, because cybercriminals can target registries in their attacks. After that, users may obtain seemingly legitimate but maliciously manipulated images for download.
Countermeasure: IT managers should only access checked and updated images from a trusted source to reduce security risks. A slim design can also reduce the attack surface: only those components that a company needs for a process should be included in the container. Image provenance should also be verified where possible, and images should be scanned for known vulnerabilities. Once images have been downloaded, updating them and checking for reported security risks should be part of routine administration.
2. Securing the Container Runtime
If attackers gain control of a container runtime, they may have multiple ways to execute malicious activity or affect other resources. They may exploit vulnerabilities to execute commands or move to other systems within the network. For example, attackers could deploy a legitimate base image, such as Ubuntu, inside a compromised environment and use the resulting container for unauthorized activity. They may also gain access to a host through a compromised container.
Countermeasure: Robust protection of the container runtime can monitor processes running in a container and related resource usage. Regular image updates can also help maintain security. Containers should also run with only the privileges and capabilities they require.
3. Securing the Container Host
If cybercriminals gain access to the container host environment, they may gain access to host processes and other resources running on the system. They may also be able to run their containers by exploiting vulnerabilities in the container host or runtime.
Countermeasure: Use Linux distributions specifically designed for running containers as part of a secure container environment. Each host server should also be securely configured, patched, and monitored. Equally important is a quick response to newly disclosed vulnerabilities. General guidelines for securely configuring operating systems can also improve security when you follow them.
4. Securing Container Orchestration and Kubernetes
Attackers may also attempt to gain administrative access to container clusters and directly access their targets. The cluster layer can give them broad control: compromised credentials for a Kubernetes cluster in a public cloud could allow an attacker to access or modify resources within the permissions assigned to that account. An externally exposed orchestration dashboard can also provide a way to manage clusters remotely without authorisation.
Countermeasure: Role-based access controls and the principle of least privilege can reduce these risks. Cloud and infrastructure providers should have only the permissions required for their responsibilities, with appropriate customer controls and authorisation where applicable. In addition, security can benefit from secured communication between pods on a Kubernetes cluster shared by different applications. Network policies can also be used to restrict unnecessary communication between workloads.
Building Stronger Container Security
Container security starts with understanding the additional security risks that containers can introduce. Organisations that understand these risks can take appropriate measures to reduce them and improve the security of their container environments. Just as attackers can apply familiar attack methods to container environments, IT security teams should also apply established security practices, including vulnerability management, patching, automated security controls, and security guidelines and training for everyone involved. A zero-trust approach can also provide an additional layer of protection. Modern IT security platforms may also use Endpoint Detection and Response (EDR) solutions and Managed Detection and Response (MDR) services as part of a layered security strategy.
