Cloud Native and App Modernization Security Concerns – Exploring Container Security

For organizations transitioning to cloud computing from a predominantly on-premise setup, a roadmap will almost certainly contain significant elements of hybrid computing. This signifies that these organizations are going to use a blend of public cloud and their own data centers to de-risk the migration to the cloud.

Whether your organization opts for a hybrid cloud approach or prefers a big-bang approach to cloud migration, the use of containerization technology can be crucial for your success. Containers improve efficiencies when developing larger applications; when deployed in a hybrid cloud environment, they can significantly boost application performance, minimize operational costs, and streamline DevOps processes.

Containers – a primer: Although containers have been around for a while, there is always an element of intrigue about them. What exactly are containers and how do they help developers build applications that can scale globally? Let’s delve a bit deeper into this.

Containers are a form of operating system virtualization. A single container can be used to run anything from a small microservice to a much larger application serving millions of end-users. Inside a container are all the necessary executables, binary code, libraries, and configuration files that the application needs to run independently. When compared to a server or machine virtualization, containers do not contain operating system images, which makes them more lightweight, portable, and much quicker to spin up.

When developers need their applications to scale, multiple containers may be deployed as container clusters that serve a peak load demand. To orchestrate a harmonious operation of such a container cluster or several container clusters, developers use services such as Kubernetes, Dockers, AWS ECS, and Azure Container Services. Container orchestration automates the deployment, management, scaling, and networking of containers.

Hybrid Cloud Environment and the Importance of Containers:

Because containers are portable and platform-independent, they are ideal for distributed development. They can run in any computing environment without modification or additional configuration. This makes them a very popular approach to building applications for and in a hybrid cloud environment.

Key drivers of the adoption of containers in a heterogeneous environment range from portability to workload automation. Let’s look at a few:

• Improved Portability: Containers give developers the ability to create smaller, better-performing workloads for their applications. This makes it easier to port and migrate workloads from on-premises to public and private cloud networks.
• Improved Workload Automation: With container orchestration services, it has become increasingly easier for developers to automate the deployment of centralized workloads across hybrid architectures. This results in a significant improvement in the scalability of containerized workloads by enabling developers to automatically augment additional clusters to their existing infrastructure resulting in lower application downtime and better performance.
• Faster cloud-native development: For most organizations, when developers write, test, and deploy applications inside containers, the environment stays the same regardless of where the application resides. Such a configuration is the ideal cloud-native state. Eventually, as organizations move to PaaS and serverless infrastructures, containers give them the flexibility they need to quickly pivot and deploy their application seamlessly without interruption across a variety of hosting services.
• Microservices and containers: Microservices-based applications can also benefit significantly from containerization. Because containers offer isolation at the operating system level, multiple components can run off a single Operating System license, helping organizations significantly reduce their costs.

Overall, containerization provides powerful capabilities to developers to build applications for a hybrid cloud environment. However, with every innovation on deployment, comes the additional burden of securing your applications.

Before we get into the details of container security, it is useful to summarize the various use cases of containers. This way, we will be able to explore the security aspect within the context of these use cases.

• “Lift and shift” existing applications into modern cloud architectures: Some organizations use containers to migrate existing applications into more modern environments that help them reduce overall costs and eliminate all concerns surrounding hardware procurement and refresh.
• Refactor existing applications for containers: Although refactoring is much more intensive than lift-and-shift migration, it enables the full benefits of a container environment and gives developers the opportunity to repay the technical debt that gets built into the application over time.
• Develop new container-native applications: Much like refactoring, this approach unlocks the full benefits of containers.
• Provide better support for micro-services architectures: Distributed applications and micro-services can be more easily isolated, deployed, and scaled using individual container building blocks.
• Provide DevOps support for Continuous Integration and Deployment (CI/CD): Container technology supports streamlined build, test, and deployment from the same container images.
• Provide easier deployment of repetitive jobs and tasks: Containers are being deployed to support one or more similar processes, which often run in the background, such as ETL functions or batch jobs.

Container Security

To understand the security limitations of containers, organizations need to pay specific attention to the fact that containers in the cloud do not have the same security boundaries as Virtual Machines (VMs). If an intruder finds a weak point in the underlying operating system, they can exploit the same weakness to get access to the container as well.

As such, the process of securing containers is continuous and should be integrated into the organization’s development process, automated to eliminate any manual intervention, and extended into the maintenance and operation of the underlying infrastructure. Let us examine a few critical aspects of container security.

Firstly, the security of the underlying infrastructure obviously impacts the vulnerabilities of the container. This includes the host security and the access and network security of the host environment. If these are compromised, then by extension, any application that is running on such a host, would be compromised too.

Secondly, application security presents another level of vulnerability that can be exploited by malicious actors. Developers, therefore, must participate in security review and adopt a proactive approach to plugging any expected security gaps in the applications they build. This includes not merely covering security fault lines in the application but preventing the code within the application to prevent triggering any malicious behavior that could impact the wider container environment.

In an environment where several containers are deployed, the orchestration stack plays a very important role. It is crucial to secure this orchestration stack in order to prevent any unauthorized access and plug this security vulnerability. By definition, containers have a short life span, and monitoring them during runtime can be extremely challenging and presents another layer of complexity to ensuring their security.

As developers build and deploy applications, the integrity of the build pipeline is another critical vulnerability that hackers often exploit. While this vulnerability is not restricted to containers, but in a CI/CD environment, it is easy for malicious actors to introduce a latent vulnerability in the container or the application at this stage.

Finally, compliance risks are very high because of the fast-moving nature of container environments. An additional dimension of complexity is the fact that containers enable microservices, which increase data traffic and network and access control complexity across the entire environment. This makes monitoring containers extremely challenging and consequently, there are security risks that need to be mitigated.

Key Functions of Container Security

To manage all the complexity around container security, we recommend that CISOs identify the most important functions that would enable a secure container deployment environment.

As detailed in the figure below, there are four key areas that need to be taken care of.

It is important to start with a Zero Trust Environment Management strategy. This ensures that in today’s world of rapidly proliferating endpoints, organizations are able to manage the dynamic security perimeter of their organization’s IT estate. With such an approach, comes micro and nano segmentations that are specifically relevant for securing a Container intensive environment.

Cloud Security Posture Management is important to establish security baselines and ensure that adequate security incident alerts and reporting mechanisms are in place. Organizations should aspire to automate the detection and elimination of misconfiguration in order to build self-healing infrastructures that can scale with the organization’s growth.

Vulnerability Management with industry-standard compliance and benchmarking needs to be maintained, with a specific focus on setting up a Risk Management Framework and compliance based on Risk Levels. This needs to be periodically reviewed and updated in light of emerging threats.

Finally, organizations need to ensure robust visibility and audit mechanism are in place and must treat any breaches or near misses with a sense of urgency. It is important to periodically schedule Cloud Security Posture Assessment and adopt a Security Analysis Platform that provides continuous visibility to potential threats to the organization’s IT estate. Standard Operating Procedures to deal with various scenarios also need to be defined and audited, along with robust response frameworks for various eventualities and potential threats.

Additionally, a Container Security Framework that includes policies, control objectives, and management platforms specific to Container Security Management must be established.

As the figure above illustrates, organizations need to thoroughly examine the entire Container stack, starting from the infrastructure level right up to the instantiation of Containers to define, manage, and report on security parameters.

Equally important is to define all stakeholders in the entire development and deployment process and identify the right tools to monitor this compliance. One of many ways to shift security left is to combat vulnerabilities before deployment — organizations need a way to subscribe to vulnerability information from upstream projects. Integrate container security scanning tools with CI/CD platforms to identify any potential runtime security issues prior to deployment.

Key Components of Container Security Tools:

As a recent paradigm in application development and deployment, security professionals have to overcome a steep learning curve in dealing with Containers and their deployment.

Traditional security tools were not designed to monitor running containers. Container security, like all security initiatives, requires visibility. Specifically, visibility of your assets beyond merely your hosts and their processes. You need to see a complete inventory of your containers, container images, and hosts. Hosts run your containers and if an attacker were to gain control of a host, it could control your entire container stack.

A comprehensive Containers security approach must include tools that are capable of a wide variety of tasks in a rapidly changing environment and significantly larger data volumes. These tools should be able to detect rogue containers by observing their signature and image drifts. When it comes to specific Container Cluster management approaches, container security tools must retain and provide visibility of Docker Swarms and Kubernetes Slave and Master containers. In a CI/CD environment, these tools must provide a base image, even during updates of the underlying application.

Continuous monitoring tools must also be adopted that continually scan for errors in container setup, specifically continuously monitoring registries for any change in vulnerability status. These tools should detect anomalies based on both – signature and behavior. Additionally, they should be able to analyze configuration settings for potential errors and throw them as exceptions through preconfigured alert engines.

As an additional layer of security, container firewalls would be crucial to deter the threat of unauthorized intrusion, and these should be configured and set up with policy engines that would govern compliance. Administrators must also ensure that the monitoring solution can ingest containers metadata to enable search or filter container inventory by labels and tags. As with every other initiative, all efforts must be made to automate tasks and processes and progressively minimize the need for manual intervention.

In a world that is pushing the limit to scalability and performance for applications that have a global user base, Containers are a game-changer and offer unprecedented power to application developers. It is equally important to adequately secure the IT perimeter with such a global scope and ensure that bad actors remain outside it.

Related Topics:

Cyber-forward Cloud Strategy for Secure Cloud Deployment and Migration

Secure Access Service Edge (SASE) – All you need to know!

Bridging the Visibility Gap on Cloud