Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud Security

11/15/2018
08:15 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Kubernetes & Containers Stir Security Concerns in the Cloud

A study by security startup StackRox finds that in the rush to incorporate Kubernetes and containers into enterprises' cloud plans, security issues are being missed.

One of the biggest and most innovative developments in the cloud over the last several years has been containers, especially the Google-backed Kubernetes orchestration platform to help manage these ecosystems and to speed up application development.

However, there's something missing: security.

With a number of high-profile breaches involving Kubernetes in the past several months, and container misconfigurations exposing sensitive data in the cloud, security startup StackRox asked 230 IT managers about their container security concerns for the company's inaugural "State of Container Security" study, which the firm released November 14. (See Don't Let Your Containers Stray Into Cryptocurrency Mining.)

It should be noted that StackRox, founded in 2014, itself makes security tools for containers and Kubernetes, however, the company's report sheds some light on a developing area of technology that many enterprises are adopting as part of digital transformation plans, as well as the trend to adopt a DevOps model of constant application development.

The whole notion of DevOps also creates tension with the security team. While one group is trying to speed development and deployment up, the other side is looking to slow things down to ensure that the infrastructure remains secure.

"The relative immaturity of the infrastructure and skill set is one area of challenge," StackRox CEO Kamal Shah wrote to Security Now in an email. "But the idea that developers will check with security first is simply not going to happen -- developers are charged with getting apps out the door, fast -- so rather than act as gate, security has to act like an advisor, having the tooling to identify when developers have missed some security steps and then giving security an effective way to pinpoint those risky assets and automatically relay the info to the involved dev teams to remediate it."

This push and pull can then lead to security concerns, In the report, over half of those surveyed -- 54% -- reported that misconfigurations and exposures of data are the main concern when it comes to Kubernetes and containers.

About 30% of respondents voiced concerns about vulnerability, while a small amount -- 17% -- reported that attacks against these platforms were their biggest security concern. However, about 44% of those surveyed reported that containers in run-time production, compared to the build and deploy phase, gave them the most concern around security.

Additionally, about one third of respondents report that their container or Kubernetes strategy does not address these types of security concerns.

The concerns about containers are also noted limited to the cloud. The study found that about 40% of all containers run in a hybrid environment, while 32% are running on-premises.

In his email, Shah noted that with containers, a traditional security team or SOC is limited in what it can offer in the way of protection. However, it's important for DevOps and security to work together, leading to another buzzword: DevSecOps.

"Given the role of DevOps in the infrastructure today, it's essential that DevOps takes ownership of the mechanics of securing this application development infrastructure, with guidance and guardrails and oversight from security," Shah wrote. "This security-focused DevOps approach is the heart of DevSecOps -- it's security engineers, embedded in DevOps, providing that input to get the infrastructure set up correctly and to get the appropriate dev teams involved when where are issues that require remediation."

However, Shah notes that there are several common-sense approaches that enterprises can take right now to secure any containers that they are running, whether in full production or merely in test and dev. A lot of these focus on restricting or limiting access to the environments, which limits the amount of employees who have access to the data.

"They can configure them with least privilege, restrict network connections to the minimum needed, and minimize the functionality so that anomalous behavior is more obvious," Shah added. "An effective container security solution will provide out-of-the-box policies that incorporate not only CIS Benchmarks but also security best practices to flag containers, orchestrators, and other assets that are not in compliance with security best practice."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26246
PUBLISHED: 2020-12-03
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
CVE-2020-29279
PUBLISHED: 2020-12-02
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVE-2020-29280
PUBLISHED: 2020-12-02
The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
CVE-2020-29282
PUBLISHED: 2020-12-02
SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.
CVE-2020-29283
PUBLISHED: 2020-12-02
An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php.