Container intrusions Do You Even IDS
Download as PPTX, PDF0 likes67 views
The document discusses the foundational benefits and security challenges of Linux application containers, emphasizing the shift in intrusion detection from traditional to container networks. It presents a security primer that includes various vulnerabilities, the effectiveness of different intrusion detection systems (IDS), and criteria for evaluating their performance. The findings indicate that the field is evolving with ongoing vulnerabilities and threats requiring continuous research and testing.
Container intrusions Do You Even IDS
- 1. 1SANS Technology Institute - Candidate for Master of Science Degree 1 Container Intrusions: Do You Even IDS? Alfredo Hickman April, 2018 GIAC GCIA, GPEN, GCIH, GSEC
- 2. SANS Technology Institute - Candidate for Master of Science Degree 2 Objectives • After this presentation, you’ll have a foundational understanding of Linux application container benefits and history. • You’ll be empowered with a security primer on Linux application containers. • You’ll understand the paradigm shift between intrusion detection and analysis in traditional vs. container networks. • You’ll be able to tests and assess different classes of container IDSs for effectiveness.
- 3. SANS Technology Institute - Candidate for Master of Science Degree 3 Linux Containers: Benefits and History 1979 Unix v7 Change Root (chroot) Early 2000’s FreeBSD Jails, Linux VServer, Solaris Zones 2002 – 2007 Control Groups (cgroups), Namespaces 2008 – 2014 LXC, Docker, rkt
- 4. SANS Technology Institute - Candidate for Master of Science Degree 4 Linux Containers: a Security Primer • Containers security challenges: complexity and speed
- 5. SANS Technology Institute - Candidate for Master of Science Degree 5 Linux Containers: a Security Primer • The lack of scholarly research into container security
- 6. SANS Technology Institute - Candidate for Master of Science Degree 6 Linux Containers: a Security Primer • The vulnerability and threat landscape of Linux containers • Synergistic-power attack • Process isolation escape • Data leakage attacks (emanations) • Spectre/Meltdown – memory read bounds control and process isolation violation • Compounded vulnerabilities • Microservices and deployment density surface area
- 7. SANS Technology Institute - Candidate for Master of Science Degree 7 Linux Containers: a Security Primer • Container security platforms and CI/CD pipeline security • Code contributor identity and access controls • Code commit integrity validation • Vulnerability management (host, packages, images) • Network, host, and container runtime component hardening • Log management, security analytics, and threat hunting
- 8. SANS Technology Institute - Candidate for Master of Science Degree 8 • Intrusion detection and analysis in traditional networks • Static or pre-defined application network port mappings • Linux kernel audit (some kernel tapping) • Network interface tapping • Network traffic profiling and security analytics Linux Containers: a Security Primer
- 9. SANS Technology Institute - Candidate for Master of Science Degree 9 • Intrusion detection and analysis in container networks • Bag of System Calls (BoSC) • Kernel tapping modules (common place) • Network interface tapping (software overlay networks) • Network observability analytics • Adaptive application traffic profiling • Adaptive application network port mapping Linux Containers: a Security Primer
- 10. SANS Technology Institute - Candidate for Master of Science Degree 10 Lab Environment
- 11. SANS Technology Institute - Candidate for Master of Science Degree 11 • Detection of scanning activity • Detection of application attacks • Detection of malware deployment • Detection of malware execution • Detection of malicious command and control • Detection of malicious privilege escalation IDS Effectiveness Criteria & Test Cases
- 12. SANS Technology Institute - Candidate for Master of Science Degree 12 IDS Effectiveness Criteria & Test Cases • Detection of malicious data exfiltration • Detection of file integrity violations • Detection of leaked system data • Auto-detection of anomalous behavior • Auto-detection of attacker, victim, infrastructure relationship • Capability for forensic artifact retrieval (PCAP, flow, logs)
- 13. SANS Technology Institute - Candidate for Master of Science Degree 13 Points Criteria 1 Not effective (method did not work) 2 Moderately effective (method worked, but did not allow for complete functionality, or equivalent to a traditional network implementation) Note: potential for assessor bias 3 Effective (method worked as effectively as a traditional network implementation) Scoring System
- 14. SANS Technology Institute - Candidate for Master of Science Degree 14 • Scenarios and Results • Security Onion with Snort and OSSEC protecting a virtualized web server hosting DVWA = 44 • Security Onion with Snort and OSSEC protecting a Dockerized web server hosting DVWA = 40 • Wazuh with OSSEC HIDS and PCI DSS module protecting a Dockerized web server hosting DVWA = 38 • Sysdig Falco with the falco-probe kernel module protecting a Dockerized web server hosting DVWA = 43 Research Review & Results
- 15. SANS Technology Institute - Candidate for Master of Science Degree 15 • Intrusion detection and analysis in traditional vs. container networks • Research, testing, and results • The field is hot, the practice is young, the vulnerabilities are ongoing, and the threats are real Summary