Nikita KoselevAnother great talk at the DevSecCon conference was "Container Security - Strengthening the Heart of your Operations", by Siddhant Khisty and Kunal Verma.
Kunal is a Community Manager at Kubesimplify.
Siddhant is a Community Manager at WeMakeDevs.
The video from the DevSecCon conference
Short sum up of this amazing talk, to give you some understanding till you can watch the whole video 😊
I really liked their definition of the container as a way to package an application with all the dependencies.
While dealing with container security, understanding of architecture is essential:
- Hypervisor
- (Operating System)
- Kernel
- Hardware
What does the container workflow look like?
What are the reasons for securing container images?
Secure Container Image improves protection against:
- Unauth Access
- Data Breaches
- Vulnerability Exploit
- Malicious Code
- Malware
- Compliance Validation
5 questions regarding your container image security.
Q1. Are the container images up-to-date?
- use stable releases
- check for available security patches or updates
Q2. Are container images scanned regularly?
- Scanning for vulnerabilities using tools like Kubescape
- Process to address the discovered security issues
Q3. Are container images verified?
- From reputable & trusted sources
- Verify integrity and authenticity
Q4. Are container images signed?
- Implement image signing using tools like cosign
- Process to verify digital signatures & ensure integrity
Q5. Is a Zero-trust model being implemented?
- Follow a zero-trust approach
- Implement strict access controls & auth mechanisms
Another key point of the talk was discussing the image registry.
Securing Image Registry is even more important than making sure your container images are secure:
- Safeguard from unathorised access or misuse
- Reduce risk of deploying compromised images
- Ensure compliance & trustworthiness
There are 4 main questions to make sure your container registry is secure.
Q1. Is the image registry public or private?
- Use private image registry
- If public, assess the potential risks + implement security measures
Q2. Is the image registry server secure?
- Restricted network access to the server
- Regular patching, hardening and monitoring
Q3. Are access controls properly configured?
- Granular access control for push, pull & modify images
- Authentication mechanism to allow only authenticated users
Q4. Are vulnerabilities being monitored?
- Regularly monitor stored container images
- Integrate vulnerability scanning tools such as trivy
Attackers have a huge playground. How can we reduce it?
- Reduce your attack surface
- Lightweight base images
- Multi-stage builds
How to choose security tools? Which parameters to consider?
- Vulnerability Scanning
- Image integrity & verification
- Runtime protection
- Complience and Audit Capabilities
Some of the tools, which are spread around #opensource ecosystem:
- Clair - Static Vulnerability Analysis
- Sysdig - Container Runtime Security
- Snyk - Container Vulnerability scan & monitoring
- Kubescape - Vulnerability Scanning for Images & Image Registry
- Falco - Run-time Security
- Trivy - Vulnerability Scanning
Takeaways:
- Image security
- Registry security
- Secure the build process
- Host Security
- Tools to make life easier
Overall it was a great talk and I am really grateful to Kunal and Siddhant for sharing their expertise.
Special thanks to @snyk_sec for powering the DevSecCon conference.
