theDocumentId => 747581 Kubernetes & Containers Stir Security Concerns in ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud Security

11/15/2018
08:15 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Kubernetes & Containers Stir Security Concerns in the Cloud

A study by security startup StackRox finds that in the rush to incorporate Kubernetes and containers into enterprises' cloud plans, security issues are being missed.

One of the biggest and most innovative developments in the cloud over the last several years has been containers, especially the Google-backed Kubernetes orchestration platform to help manage these ecosystems and to speed up application development.

However, there's something missing: security.

With a number of high-profile breaches involving Kubernetes in the past several months, and container misconfigurations exposing sensitive data in the cloud, security startup StackRox asked 230 IT managers about their container security concerns for the company's inaugural "State of Container Security" study, which the firm released November 14. (See Don't Let Your Containers Stray Into Cryptocurrency Mining.)

It should be noted that StackRox, founded in 2014, itself makes security tools for containers and Kubernetes, however, the company's report sheds some light on a developing area of technology that many enterprises are adopting as part of digital transformation plans, as well as the trend to adopt a DevOps model of constant application development.

(Source: Pixabay)\r\n
(Source: Pixabay)\r\n

The whole notion of DevOps also creates tension with the security team. While one group is trying to speed development and deployment up, the other side is looking to slow things down to ensure that the infrastructure remains secure.

"The relative immaturity of the infrastructure and skill set is one area of challenge," StackRox CEO Kamal Shah wrote to Security Now in an email. "But the idea that developers will check with security first is simply not going to happen -- developers are charged with getting apps out the door, fast -- so rather than act as gate, security has to act like an advisor, having the tooling to identify when developers have missed some security steps and then giving security an effective way to pinpoint those risky assets and automatically relay the info to the involved dev teams to remediate it."

This push and pull can then lead to security concerns, In the report, over half of those surveyed -- 54% -- reported that misconfigurations and exposures of data are the main concern when it comes to Kubernetes and containers.

About 30% of respondents voiced concerns about vulnerability, while a small amount -- 17% -- reported that attacks against these platforms were their biggest security concern. However, about 44% of those surveyed reported that containers in run-time production, compared to the build and deploy phase, gave them the most concern around security.

Additionally, about one third of respondents report that their container or Kubernetes strategy does not address these types of security concerns.

The concerns about containers are also noted limited to the cloud. The study found that about 40% of all containers run in a hybrid environment, while 32% are running on-premises.

In his email, Shah noted that with containers, a traditional security team or SOC is limited in what it can offer in the way of protection. However, it's important for DevOps and security to work together, leading to another buzzword: DevSecOps.

"Given the role of DevOps in the infrastructure today, it's essential that DevOps takes ownership of the mechanics of securing this application development infrastructure, with guidance and guardrails and oversight from security," Shah wrote. "This security-focused DevOps approach is the heart of DevSecOps -- it's security engineers, embedded in DevOps, providing that input to get the infrastructure set up correctly and to get the appropriate dev teams involved when where are issues that require remediation."

However, Shah notes that there are several common-sense approaches that enterprises can take right now to secure any containers that they are running, whether in full production or merely in test and dev. A lot of these focus on restricting or limiting access to the environments, which limits the amount of employees who have access to the data.

"They can configure them with least privilege, restrict network connections to the minimum needed, and minimize the functionality so that anomalous behavior is more obvious," Shah added. "An effective container security solution will provide out-of-the-box policies that incorporate not only CIS Benchmarks but also security best practices to flag containers, orchestrators, and other assets that are not in compliance with security best practice."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37443
PUBLISHED: 2021-07-25
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37444
PUBLISHED: 2021-07-25
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Au...
CVE-2021-37445
PUBLISHED: 2021-07-25
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37446
PUBLISHED: 2021-07-25
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVE-2021-37447
PUBLISHED: 2021-07-25
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.