Container Security Mmanagement
- 1. Container Security Management Suresh Rupasinghe Associate Tech Lead - WSO2
- 3. What is a Container? A standardized unit of software ● Lightweight ● Standalone Cloud Native Security Container Runtimes: ● Docker ● rkt
- 4. Comparing Containers and Virtual Machines Container Virtual Machine
- 5. What is Kubernetes? K8s is an open-source system for automating deployment, scaling, and management of containerized applications. Cloud Native Security
- 6. Traditional Approach vs. Modern Application Approach Cloud Native Security
- 7. Demo
- 8. Containers & K8s Attack Vectors Poisoned ImagesKernel Attack Denial of Service Cloud Native Security Container Breakouts Sniffing Secrets
- 9. The Attack Kill Chain 1. Recon 2. Weaponization 3. Delivery 4. Exploitation 5. Installation 6. Command & Control 7. Exfiltration Cloud Native Security
- 10. Recent Attacks…!!! Cloud Native Security
- 11. Container Security Stack Container Security Infrastructure Pod Security Policies Network Filtering Secrets Management Build Code Analysis Image Scanning Deployment Check Runtime Anomaly Detection Forensics Run-Time Vulnerability Scanning Cloud Native Security
- 13. Securing CI/CD Pipeline Cloud Native Security Docker Hub
- 14. Sample Dockerfile & K8s Deployment file Cloud Native Security
- 15. Securing CI/CD Pipeline 1. Image Scanning ● Clair by CoreOS ● Anchore 2. Code Analysis 3. Deployment Checks ● Kubesec.io Cloud Native SecurityCloud Native Security
- 17. Infrastructure Layer Security 1. Pod Security Policies ● Kubernetes Pod Security Policy Advisor 2. Network Filtering ● Cilium Cloud Native SecurityCloud Native Security
- 19. Run-time Security 1. Anomalous Behavior Detection ■ Falco 2. Runtime Vulnerability Scanning 3. Security Auditing Cloud Native Security
- 20. OWASP Best Practices RULE #0 - Keep Host and Docker up to date RULE #1 - Do not expose the Docker daemon socket RULE #2 - Set a user RULE #3 - Limit capabilities (Grant only specific capabilities, needed by a container) RULE #4 - Add –no-new-privileges flag Cloud Native Security
- 21. OWASP Best Practices - RULE #5 - Disable inter-container communication (--icc=false) RULE #6- Use Linux Security Module (seccomp, AppArmor, or SELinux) RULE #7 - Limit resources (memory, CPU, file descriptors, processes, restarts) RULE #8 - Set filesystem and volumes to read-only RULE #9 - Use static analysis tools RULE #10 - Set the logging level to at least INFO Cloud Native Security
- 22. Secret Management Kubernetes Level ● Kubernetes secret ● HashiCorp Vault Source Code Level ● Helm Secrets ● Sealed Secrets Cloud Native Security
- 23. References: ● https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1---do-n ot-expose-the-docker-daemon-socket-even-to-the-containers ● https://www.youtube.com/channel/UCvqbFHwN-nwalWPjPUKpvTA ● https://istio.io/ ● https://www.youtube.com/watch?v=Jbqxsli2tRw ● https://www.youtube.com/watch?v=15bsTualHnA ● https://www.youtube.com/watch?v=Uocf67aD5QQ ● https://www.openpolicyagent.org/ ● https://spiffe.io/
- 24. Q&A
- 25. THANK YOU