Kubernetes & Containers Stir Security Concerns in the Cloud

One of the biggest and most innovative developments in the cloud over the last several years has been containers, especially the Google-backed Kubernetes orchestration platform to help manage these ecosystems and to speed up application development.

However, there's something missing: security.

With a number of high-profile breaches involving Kubernetes in the past several months, and container misconfigurations exposing sensitive data in the cloud, security startup StackRox asked 230 IT managers about their container security concerns for the company's inaugural "State of Container Security" study, which the firm released November 14. (See Don't Let Your Containers Stray Into Cryptocurrency Mining.)

It should be noted that StackRox, founded in 2014, itself makes security tools for containers and Kubernetes, however, the company's report sheds some light on a developing area of technology that many enterprises are adopting as part of digital transformation plans, as well as the trend to adopt a DevOps model of constant application development.

(Source: Pixabay)\r\n

The whole notion of DevOps also creates tension with the security team. While one group is trying to speed development and deployment up, the other side is looking to slow things down to ensure that the infrastructure remains secure.

"The relative immaturity of the infrastructure and skill set is one area of challenge," StackRox CEO Kamal Shah wrote to Security Now in an email. "But the idea that developers will check with security first is simply not going to happen -- developers are charged with getting apps out the door, fast -- so rather than act as gate, security has to act like an advisor, having the tooling to identify when developers have missed some security steps and then giving security an effective way to pinpoint those risky assets and automatically relay the info to the involved dev teams to remediate it."

This push and pull can then lead to security concerns, In the report, over half of those surveyed -- 54% -- reported that misconfigurations and exposures of data are the main concern when it comes to Kubernetes and containers.

About 30% of respondents voiced concerns about vulnerability, while a small amount -- 17% -- reported that attacks against these platforms were their biggest security concern. However, about 44% of those surveyed reported that containers in run-time production, compared to the build and deploy phase, gave them the most concern around security.

Additionally, about one third of respondents report that their container or Kubernetes strategy does not address these types of security concerns.

The concerns about containers are also noted limited to the cloud. The study found that about 40% of all containers run in a hybrid environment, while 32% are running on-premises.

In his email, Shah noted that with containers, a traditional security team or SOC is limited in what it can offer in the way of protection. However, it's important for DevOps and security to work together, leading to another buzzword: DevSecOps.

"Given the role of DevOps in the infrastructure today, it's essential that DevOps takes ownership of the mechanics of securing this application development infrastructure, with guidance and guardrails and oversight from security," Shah wrote. "This security-focused DevOps approach is the heart of DevSecOps -- it's security engineers, embedded in DevOps, providing that input to get the infrastructure set up correctly and to get the appropriate dev teams involved when where are issues that require remediation."

However, Shah notes that there are several common-sense approaches that enterprises can take right now to secure any containers that they are running, whether in full production or merely in test and dev. A lot of these focus on restricting or limiting access to the environments, which limits the amount of employees who have access to the data.

"They can configure them with least privilege, restrict network connections to the minimum needed, and minimize the functionality so that anomalous behavior is more obvious," Shah added. "An effective container security solution will provide out-of-the-box policies that incorporate not only CIS Benchmarks but also security best practices to flag containers, orchestrators, and other assets that are not in compliance with security best practice."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.