Application Security

Container Deployments Bring Security Woes at DevOps Speed

Nearly half of all companies know that they're deploying containers with security flaws, according to a new survey.

Companies are rushing to deploy containers in their application infrastructure — and in that rush, they're deploying containers that they know are insecure. That's one of the conclusions reached in a new report that looks at the state of container security.

The Tripwire State of Container Security Report was conducted in partnership with Dimensional Research. The study finds that companies are unsure about container security, and they're paying a price for that insecurity.

That price is paid in security incidents: 60% of those surveyed say that their organization suffered a container security breach in the last year. Tim Erlin, vice president of product management and strategy at Tripwire, says that he was surprised by that number because there are relatively few reports of container breaches in the news media.

And the security issues don't mean that companies aren't concerned with security. Ninety-four percent of respondents to the survey say that security is one of their significant container concerns. "The first thing they want is how to detect bad things happening; the second is how to prevent those bad things," says Erlin.

Not surprisingly, the level of concern tends to rise with the number of deployed containers. Thirty-four percent of those with fewer than 10 containers describe themselves as "very concerned" about security, while 54% of those with more than 100 containers deployed describe themselves with the same language.

The solution for the container security problem lies in the development cycle, Erlin says. "The way to address container security is to build security controls into the DevOps process. If you're looking for vulnerabilities or mis-compliance, you want to find them in the build ahead of deployment, and you want to make sure the process will allow them to be fixed before deploying," he explains.

Too many companies are using traditional security scanning processes, in which they scan for vulnerabilities when the application is deployed, and then try to fix issues in a DevOps process — and they're finding that it doesn't work, Erlin says. The problem isn't primarily with the tools they're using.

"I don't think this is a technology challenge as much as an adoption challenge. There are tools available today in a variety of quality from a variety of companies, but we haven't seen DevOps organizations adopting them as part of the build process," Erlin says. Looking ahead, though, he sees promise in the form of new employees being hired to work with containers.

"I was talking to an analyst this morning, and he said that companies are seeing new hires bring the container technology with them from their time in colleges and universities," he says. Still, the new hires are no quick fix: 71% of those in the survey say that they expect to see more container security incidents in the coming year.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PaulChau
50%
50%
PaulChau,
User Rank: Apprentice
1/28/2019 | 9:22:56 PM
Bigger things are coming
I would not be surprised if those figures continue to increase in the coming years. People are starting to realise that there is value in targeting information held in storage containers in companies and more importantly in cloud storage spaces. Such easy access for people who are looking for a payout...
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Apprentice
1/27/2019 | 11:16:32 PM
Put a stop now
It is good that they are aware of their current situation now as opposed to being exposed to the truth only at a much later date when too much damage might have already been done. On their next phase of deploying storage containers, they need to already have an alternative put in motion should they wish to put a stop to this underlying issue.
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20122
PUBLISHED: 2019-02-21
The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vulnerable to a command injection vulnerability that can be exploited to achieve remote code execution with root privileges. No authentication is...
CVE-2018-6687
PUBLISHED: 2019-02-21
Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.
CVE-2019-8982
PUBLISHED: 2019-02-21
com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.