Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud Security

11/15/2018
08:15 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Kubernetes & Containers Stir Security Concerns in the Cloud

A study by security startup StackRox finds that in the rush to incorporate Kubernetes and containers into enterprises' cloud plans, security issues are being missed.

One of the biggest and most innovative developments in the cloud over the last several years has been containers, especially the Google-backed Kubernetes orchestration platform to help manage these ecosystems and to speed up application development.

However, there's something missing: security.

With a number of high-profile breaches involving Kubernetes in the past several months, and container misconfigurations exposing sensitive data in the cloud, security startup StackRox asked 230 IT managers about their container security concerns for the company's inaugural "State of Container Security" study, which the firm released November 14. (See Don't Let Your Containers Stray Into Cryptocurrency Mining.)

It should be noted that StackRox, founded in 2014, itself makes security tools for containers and Kubernetes, however, the company's report sheds some light on a developing area of technology that many enterprises are adopting as part of digital transformation plans, as well as the trend to adopt a DevOps model of constant application development.

(Source: Pixabay)\r\n
(Source: Pixabay)\r\n

The whole notion of DevOps also creates tension with the security team. While one group is trying to speed development and deployment up, the other side is looking to slow things down to ensure that the infrastructure remains secure.

"The relative immaturity of the infrastructure and skill set is one area of challenge," StackRox CEO Kamal Shah wrote to Security Now in an email. "But the idea that developers will check with security first is simply not going to happen -- developers are charged with getting apps out the door, fast -- so rather than act as gate, security has to act like an advisor, having the tooling to identify when developers have missed some security steps and then giving security an effective way to pinpoint those risky assets and automatically relay the info to the involved dev teams to remediate it."

This push and pull can then lead to security concerns, In the report, over half of those surveyed -- 54% -- reported that misconfigurations and exposures of data are the main concern when it comes to Kubernetes and containers.

About 30% of respondents voiced concerns about vulnerability, while a small amount -- 17% -- reported that attacks against these platforms were their biggest security concern. However, about 44% of those surveyed reported that containers in run-time production, compared to the build and deploy phase, gave them the most concern around security.

Additionally, about one third of respondents report that their container or Kubernetes strategy does not address these types of security concerns.

The concerns about containers are also noted limited to the cloud. The study found that about 40% of all containers run in a hybrid environment, while 32% are running on-premises.

In his email, Shah noted that with containers, a traditional security team or SOC is limited in what it can offer in the way of protection. However, it's important for DevOps and security to work together, leading to another buzzword: DevSecOps.

"Given the role of DevOps in the infrastructure today, it's essential that DevOps takes ownership of the mechanics of securing this application development infrastructure, with guidance and guardrails and oversight from security," Shah wrote. "This security-focused DevOps approach is the heart of DevSecOps -- it's security engineers, embedded in DevOps, providing that input to get the infrastructure set up correctly and to get the appropriate dev teams involved when where are issues that require remediation."

However, Shah notes that there are several common-sense approaches that enterprises can take right now to secure any containers that they are running, whether in full production or merely in test and dev. A lot of these focus on restricting or limiting access to the environments, which limits the amount of employees who have access to the data.

"They can configure them with least privilege, restrict network connections to the minimum needed, and minimize the functionality so that anomalous behavior is more obvious," Shah added. "An effective container security solution will provide out-of-the-box policies that incorporate not only CIS Benchmarks but also security best practices to flag containers, orchestrators, and other assets that are not in compliance with security best practice."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
CVE-2021-32244
PUBLISHED: 2021-06-16
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
CVE-2021-32245
PUBLISHED: 2021-06-16
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" t...
CVE-2021-34201
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes.
CVE-2021-34203
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify ...