7 Container Components That Increase a Network's Security
A proof of concept at Interop19 showed just how simple a container deployment can be.
June 4, 2019
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0900081337e89bd4/64f0d413df86f7480f579205/IMG_0537.jpg?width=700&auto=webp&quality=80&disable=upscale)
Containers are a very big deal in enterprise computing right now. If your organization isn't already using them, then trends indicate it probably will soon. This application virtualization technology has had profound implications for some companies that have embraced DevOps, and there is plenty of potential for it to have a similar impact on security operations.
To understand why, it's good to start with an understanding of just what containers are. A modern application is a collection of pieces of code: the main application itself, configuration files, and custom files on which it depends. These tend to be unique to the application as it's configured to be deployed on a given server.
A container bundles all of these things up into an image that can be saved and deployed quickly, consistently, and automatically across multiple servers. If differences exist in the operating system details between the development and production servers, the container insulates the application from them, making application movement between development and operations very fast and straightforward.
So what are the implications for security in all of this? One is that containers can allow vulnerabilities to quickly propagate if developers trust that all code in an image has been properly reviewed and updated. Conversely, a more positive implication is that specific network and application configurations can be tested, saved as images, and then automatically deployed when an attack, malware, or other problem takes the network or application delivery system down.
Because container technology is still relatively new, many IT managers are reluctant to depend on it. They also worry about complexity. But fear not: At Interop19, the Network Orchestration Hands-on Showcase decided to do a proof of concept that showed just how simple a container deployment can be — and why containers can be important to even a smaller organization. The demonstration involved primary and secondary network links with monitoring and network control applications deployed on the simplest of servers — Raspberry Pis.
Here, we'll look at the individual components used in the showcase and how each could be used by a security team to replicate the work done at Interop. Most are software, a couple are languages (or language-like), and one is hardware. (To help those who are interested in replicating its experiment, the Interop Demonstration Lab team has placed all of its containers and support code on GitHub.)
Is your organization using containers? Are you using them in your security infrastructure? Let us know in the Comments, below.
(Image: Curtis Franklin, Jr. for Dark Reading)
YAML (YAML Ain't Markup Language) is the language used for creating Ansible plays and for many of the other services used in container automation. Described by its developers and maintainers as a "data serialization language," YAML can be used in conjunction with many other programming languages to script actions and control the flow of data in and out of processes.
YAML is not new; a look at the official website shows that major development steps were completed by 2011. Because it is mature, YAML is well-understood and stable, making it a solid tool for developing security applications and processes.
While YAML is the language used to create the sequences of actions recorded as plays in the Ansible playbooks, JSON (JavaScript Object Notation) is the language used to describe and communicate the data used to detect the presence of an error or fault condition of the switch, and pass remediation commands back to the software controlling the switch in response.
JSON has become the data description language in networking and security control applications, taking the role many believed XML would take two decades ago. JSON is a very simple data descriptor language that has been integrated into every major programming and scripting language in current use. It was a necessary choice for the demo network team; no other data description language is used by so many hardware and software components in security and networking.
Few computers have had the impact of the Raspberry Pi when it comes to encouraging experimentation and creativity in application design. Small, low-cost (OK, cheap), and with low -power requirements, the Raspberry Pi puts a full Linux server into a package smaller than the average deck of playing cards.
In order to showcase the simplicity and low cost of container-based networking and security automation, the demonstration network team decided to use combination of donated laptop computers and Raspberry Pis. Most of the containers were able to be deployed on the small Linux computers using images downloaded from the demo team's GitHub site.
The point of the demo was to give attendees something to inspire their own work when they returned to their organization, the University of Wisconsin's Jensen says. "We've had people come in, and we encourage them to download the code themselves," he says. "If they don't have Docker on their machine, they can use the directions [on our GitHub] to go get Docker, download our material on GitHub to their machine, then build the container and run it themselves so they can actually do exactly what we're doing."
Security automation and network automation are each beginning to be seen in growing numbers of networks. The simple demonstration network at Interop19 showed that understanding container-based automation and creating a proof of concept are within the capabilities of even small security teams.
Few computers have had the impact of the Raspberry Pi when it comes to encouraging experimentation and creativity in application design. Small, low-cost (OK, cheap), and with low -power requirements, the Raspberry Pi puts a full Linux server into a package smaller than the average deck of playing cards.
In order to showcase the simplicity and low cost of container-based networking and security automation, the demonstration network team decided to use combination of donated laptop computers and Raspberry Pis. Most of the containers were able to be deployed on the small Linux computers using images downloaded from the demo team's GitHub site.
The point of the demo was to give attendees something to inspire their own work when they returned to their organization, the University of Wisconsin's Jensen says. "We've had people come in, and we encourage them to download the code themselves," he says. "If they don't have Docker on their machine, they can use the directions [on our GitHub] to go get Docker, download our material on GitHub to their machine, then build the container and run it themselves so they can actually do exactly what we're doing."
Security automation and network automation are each beginning to be seen in growing numbers of networks. The simple demonstration network at Interop19 showed that understanding container-based automation and creating a proof of concept are within the capabilities of even small security teams.
Containers are a very big deal in enterprise computing right now. If your organization isn't already using them, then trends indicate it probably will soon. This application virtualization technology has had profound implications for some companies that have embraced DevOps, and there is plenty of potential for it to have a similar impact on security operations.
To understand why, it's good to start with an understanding of just what containers are. A modern application is a collection of pieces of code: the main application itself, configuration files, and custom files on which it depends. These tend to be unique to the application as it's configured to be deployed on a given server.
A container bundles all of these things up into an image that can be saved and deployed quickly, consistently, and automatically across multiple servers. If differences exist in the operating system details between the development and production servers, the container insulates the application from them, making application movement between development and operations very fast and straightforward.
So what are the implications for security in all of this? One is that containers can allow vulnerabilities to quickly propagate if developers trust that all code in an image has been properly reviewed and updated. Conversely, a more positive implication is that specific network and application configurations can be tested, saved as images, and then automatically deployed when an attack, malware, or other problem takes the network or application delivery system down.
Because container technology is still relatively new, many IT managers are reluctant to depend on it. They also worry about complexity. But fear not: At Interop19, the Network Orchestration Hands-on Showcase decided to do a proof of concept that showed just how simple a container deployment can be — and why containers can be important to even a smaller organization. The demonstration involved primary and secondary network links with monitoring and network control applications deployed on the simplest of servers — Raspberry Pis.
Here, we'll look at the individual components used in the showcase and how each could be used by a security team to replicate the work done at Interop. Most are software, a couple are languages (or language-like), and one is hardware. (To help those who are interested in replicating its experiment, the Interop Demonstration Lab team has placed all of its containers and support code on GitHub.)
Is your organization using containers? Are you using them in your security infrastructure? Let us know in the Comments, below.
(Image: Curtis Franklin, Jr. for Dark Reading)
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024