ironing out Docker
- 1. ironing out Docker at ironPeak services ironpeak.be
- 2. 1. $ whoami 1 - whoami ironpeak.be Niels Hofmans role Independent Cybersecurity Consultant work Code Security, App Security, Hardening, F5 BIG-IP interest Go, Docker, Cloud, Media contact hello@ironpeak.be github github.com/HazCod
- 3. 2. $ tree 2 - tree ironpeak.be user host image Runtime
- 4. 3. $ client 3 - client ironpeak.be The Client (you!) - Hidden attack surface - Several attack vectors - Phishing - Hardware - Software - Open-Source - Social Networks - Reused/shared Passwords
- 5. 3. $ client 3 - client ironpeak.be The Client (you!) - Awareness - Phishing - Common Sense - E-mail headers, content, DMARC - Hardware - Disk encryption - Lock-down BIOS/SMC - Trustless with 2FA - Lock your session
- 6. 3. $ client 3 - client ironpeak.be The Client (you!) - Software - OS Hardening - Non-privileged User - Firewall - Patching - Verify & Tag Open-Source - Additional - Information leakage: e.g. LinkedIn, Github - Password manager with 2FA
- 7. 4. $ host 4 - host ironpeak.be Host hardening - CIS Benchmarks - Firewall Daemon hardening - CIS Benchmarks, docker-bench-security, kube-bench - User Namespace Remapping - Live Restore - No experimental features - Swarm autolock - Kernel hardening: github.com/google/gvisor - Enable SELinux/AppArmor + seccomp
- 8. 4. $ host 4 - host ironpeak.be Daemon Access - UNIX Socket over SSH - HTTP+TLS auth Host Auditing - Off-site log server over TLS/SSH - Log forging / Denial of Service - Audit tracing e.g. sysdig.org + falco.org, github.com/netdata/netdata Private Registry - client: DOCKER_CONTENT_TRUST=1 - daemon: content_trust: enforced
- 9. 5. $ image 5 - image ironpeak.be - DIY & Commercial - Base images: alpine (!), minideb, centos github.com/GoogleContainerTools/distroless - docker-slim - Image Signing - Leakage - .dockerignore - docker secrets/vault - Remove defaults - Network: bridge - Storage: AUFS
- 10. 5. $ image 5 - image ironpeak.be Dockerfile - Linters; hadolint, … - Pin package versions - Least Privilege - users $user & root without shells - strict permissions - remove unnecessary tooling - security-opt=no-new-privileges - read-only (+ tmpfs) - COPY --chown=x:x instead of ADD - Scan for package vulnerabilities
- 11. 5. $ image.findWally() 5 - image ironpeak.be
- 12. 5. $ image.findWally() 5 - image ironpeak.be USER?
- 13. 5. $ image.getFixed() 5 - image ironpeak.be
- 14. 6. $ runtime: container 6 - runtime ironpeak.be Container Runtime Properties - Read-Only filesystem - mounts: noexec, nodev, nosuid, mode, size, uid/gid - cgroup limits - restart: on-failure:5 - cap_drop: ALL - security_opt: - no_new_privileges - SELinux/AppArmor + seccomp - Environment vs. Secrets
- 15. 6. $ runtime: app 6 - runtime ironpeak.be Application Security - OWASP ASVS: Level 1 - Level 3 - web: github.com/OWASP/ASVS - mobile: github.com/OWASP/owasp-masvs - Static Application Security Testing (SAST) - linters - OSS + commercial - Dynamic Application Security Testing (DAST) - OpenVAS, OWASP ZAP, … - Training & Awareness!
- 16. 7. $ exit 7 - exit ironpeak.be https://ironpeak.be/slides/190319-ironing-out-docker.pdf