App sec in the time of docker containers
2 likes1,352 views
The document discusses application security in the context of Docker containers, emphasizing the importance of balancing developer productivity with security. It outlines best practices for securely using Docker, including following the CIS Docker benchmark and employing continuous testing. The author highlights practical steps for implementing security measures and shares anecdotal evidence of Docker-related vulnerabilities.
App sec in the time of docker containers
- 1. APP SEC IN THE TIME OF DOCKER CONTAINERS Akash Mahajan - Director Appsecco C0C0N 2016
- 2. SOMETHING ABOUT ME ➤ Director of Appsecco ➤ Appsecco is a specialist application security company ➤ Author of ‘Burp Suite Essentials’ ➤ Burp Suite is the most popular software for security testing applications ➤ Community Champion ➤ OWASP Bangalore Chapter Leader ➤ n|u Co-Founder and Community Manager ➤ Co-Trainer of Xtreme Web Hacking Class ➤ Links ➤ @makash | https://linkd.in/webappsecguy | akashm.com
- 3. “There is space for only 5 types of security approaches in this world -Said no one ever
- 4. HOW WE DO APPSEC CURRENTLY?
- 5. AUTOMATED WEB APPLICATION SCANNERS
- 6. BUG BOUNTY BEGINNERS - WIN SOME - LOSE SOME
- 7. BUG BOUNTY/PENTESTERS & EXPERTS MAKE IT LOOK SIMPLE
- 8. SECURITY TESTERS PLOD AWAY USING CHECKLISTS & TOOLS
- 9. WHAT IS A DOCKER CONTAINER?
- 10. A DOCKER CONTAINER? ➤ A container allows a developer to package up and application and all of its dependent parts in a box ➤ This box is basically an isolated environment and the application has everything it needs to run inside of this environment
- 11. CONTAINERS ARE COMING A value of 100 is the peak popularity for a term DOCKER IN GOOGLE TRENDS SINCE JUL 2013-PRESENT
- 12. IF THE DRY GRAPH WASN’T ENOUGH TO CONVINCE YOU
- 13. “Why has this change to docker become imminent? -Me, when I started noticing how quickly the developer world was moving to docker
- 14. REPEAT AFTER ME DEVELOPER PRODUCTIVITY DEVELOPER PRODUCTIVITY DEVELOPER PRODUCTIVITY
- 15. “Regardless of how much security folks think their opinion matters, most of the developers don’t give a fish about what we think - Akash Mahajan, learning the truth the hard way
- 16. THIS IS WHAT DEVELOPERS WANT - AN IT FREE WORLD Attribution pending. Will update the slides once I know where I nicked this from!
- 17. BUT ISN’T THIS JUST LIKE CHROOT?
- 19. “If a developer has to choose between being productive or being secure, more or less she/he will chose being productive - Something I should have said!
- 20. WHAT CAN WE DO NOW TO GET ON THE BANDWAGON? ➤ Depends on how you do application security ➤ For testing applications ➤ We usually need the setup running somewhere (testing) ➤ Being able to get the complete setup by just running a simple command, makes all of us “productive” ➤ For secure development ➤ Pre-configured dockerfiles with selective containers which allow for secure configuration by default ➤ For secure operations ➤ Running docker in secured, isolated instances
- 21. DOES DOCKER PROVIDE ISOLATION FROM THE HOST? ➤ Yes if you practice defence in depth ➤ Follow the CIS Docker Benchmark to get a checklist of things to do on ➤ Host Configuration (15 list items) ➤ Docker Daemon Configuration (13 list items) ➤ Files, Permissions and configuration files for Docker Daemon (20 list items) ➤ Container Images (5 list items) ➤ Container Runtime (25 list items) ➤ Follow Docker Security Operations Best Practices
- 22. DOCKER HOST AND CONTAINER SECURITY GETTING STARTED Start by reading Understanding docker security and best practices https://blog.docker.com/2015/05/understanding-docker-security-and- best-practices/ Use the Docker Bench Security script to automatically check best practices as outlined by the CIS Docker Benchmark version 1.11 https:// github.com/docker/docker-bench-security Play this awesome game to break out of docker containers in your browser https://contained.af/ Read the full CIS Docker 1.11.0 Benchmark report https:// benchmarks.cisecurity.org/tools2/docker/ CIS_Docker_1.11.0_Benchmark_v1.0.0.pdf Definitely read if you plan to run docker in prod or are guiding someone who does http://container-solutions.com/is-docker-safe-for-production/
- 23. NEW TOOLS, APPROACHES AND OPPORTUNITIES The configuration for docker containers will need to be tested in a continuous manner Auditing of existing deployments against security benchmarks like the CIS Docker Benchmark Following agile practices, dockers build built using CI/CD tools like Jenkins based on pre-commit and post-commit hooks Bring in your SAST, DAST, *ST analysis at any point in this pipeline Setting up and managing private registries Also setting up private repositories for nom etc.
- 24. TO START WITH, THIS IS WHAT YOU SHOULD DO Test the application as you normally would If you find appsec issues report these Do white box assessment with the docker security checklists You already have a roadmap as mentioned in slide 21 & 22 Keep track of any privilege escalation bugs in docker daemon or the underlying hypervisor/VM tech you are using Understand what is the software supply chain for the application & pick secure alternatives for orchestration itself Application containers make it simple for everyone so use them for training, best practices etc.
- 25. DOCKER FAILS Couple of #devoops moments
- 26. TWITTER’S VINE SOURCE CODE DUMP BY @AVICODER ➤ @avicoder a bug bounty hunter, he spoke about this bug at a null/ OWASP/G4H Bangalore meet in June 2016 ➤ He found an interesting sub domain for Vine ( A twitter video app) ➤ He had stumbled upon a private docker registry being used ➤ He realised that the version being used didn’t use any authentication and by querying the API he determined the docker files being hosted ➤ He did a docker pull of an image that contained the source code for the Vine App and got $$$$$ bounty ➤ https://avicoder.me/2016/07/22/Twitter-Vine-Source-code-dump/
- 27. DOCKER IMAGE INSECURITY ➤ This has been fixed now! Especially from docker version 1.10 ➤ Earlier if an image had been compressed with xz (in C so not safety for memory) ➤ Docker Daemon would exec the xz binary as root user ➤ If there was a single vulnerability in xz, a docker pull could result in complete compromise ➤ Read more about the vulnerability https://titanous.com/ posts/docker-insecurity ➤ Read more about how this was fixed https://titanous.com/ posts/docker-insecurity
- 28. QUESTIONS @makash | https://linkd.in/webappsecguy | akashm.com