Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud Security

11/15/2018
08:15 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Kubernetes & Containers Stir Security Concerns in the Cloud

A study by security startup StackRox finds that in the rush to incorporate Kubernetes and containers into enterprises' cloud plans, security issues are being missed.

One of the biggest and most innovative developments in the cloud over the last several years has been containers, especially the Google-backed Kubernetes orchestration platform to help manage these ecosystems and to speed up application development.

However, there's something missing: security.

With a number of high-profile breaches involving Kubernetes in the past several months, and container misconfigurations exposing sensitive data in the cloud, security startup StackRox asked 230 IT managers about their container security concerns for the company's inaugural "State of Container Security" study, which the firm released November 14. (See Don't Let Your Containers Stray Into Cryptocurrency Mining.)

It should be noted that StackRox, founded in 2014, itself makes security tools for containers and Kubernetes, however, the company's report sheds some light on a developing area of technology that many enterprises are adopting as part of digital transformation plans, as well as the trend to adopt a DevOps model of constant application development.

(Source: Pixabay)\r\n
(Source: Pixabay)\r\n

The whole notion of DevOps also creates tension with the security team. While one group is trying to speed development and deployment up, the other side is looking to slow things down to ensure that the infrastructure remains secure.

"The relative immaturity of the infrastructure and skill set is one area of challenge," StackRox CEO Kamal Shah wrote to Security Now in an email. "But the idea that developers will check with security first is simply not going to happen -- developers are charged with getting apps out the door, fast -- so rather than act as gate, security has to act like an advisor, having the tooling to identify when developers have missed some security steps and then giving security an effective way to pinpoint those risky assets and automatically relay the info to the involved dev teams to remediate it."

This push and pull can then lead to security concerns, In the report, over half of those surveyed -- 54% -- reported that misconfigurations and exposures of data are the main concern when it comes to Kubernetes and containers.

About 30% of respondents voiced concerns about vulnerability, while a small amount -- 17% -- reported that attacks against these platforms were their biggest security concern. However, about 44% of those surveyed reported that containers in run-time production, compared to the build and deploy phase, gave them the most concern around security.

Additionally, about one third of respondents report that their container or Kubernetes strategy does not address these types of security concerns.

The concerns about containers are also noted limited to the cloud. The study found that about 40% of all containers run in a hybrid environment, while 32% are running on-premises.

In his email, Shah noted that with containers, a traditional security team or SOC is limited in what it can offer in the way of protection. However, it's important for DevOps and security to work together, leading to another buzzword: DevSecOps.

"Given the role of DevOps in the infrastructure today, it's essential that DevOps takes ownership of the mechanics of securing this application development infrastructure, with guidance and guardrails and oversight from security," Shah wrote. "This security-focused DevOps approach is the heart of DevSecOps -- it's security engineers, embedded in DevOps, providing that input to get the infrastructure set up correctly and to get the appropriate dev teams involved when where are issues that require remediation."

However, Shah notes that there are several common-sense approaches that enterprises can take right now to secure any containers that they are running, whether in full production or merely in test and dev. A lot of these focus on restricting or limiting access to the environments, which limits the amount of employees who have access to the data.

"They can configure them with least privilege, restrict network connections to the minimum needed, and minimize the functionality so that anomalous behavior is more obvious," Shah added. "An effective container security solution will provide out-of-the-box policies that incorporate not only CIS Benchmarks but also security best practices to flag containers, orchestrators, and other assets that are not in compliance with security best practice."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-21602
PUBLISHED: 2021-09-16
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file.
CVE-2020-21603
PUBLISHED: 2021-09-16
libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.
CVE-2020-21604
PUBLISHED: 2021-09-16
libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.
CVE-2020-21605
PUBLISHED: 2021-09-16
libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.
CVE-2020-21606
PUBLISHED: 2021-09-16
libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.