Container Security - GAVS Technologies

Containers are different from Virtual Machines, where VMs need a guest operating system, running on a host operating system, where CPU, Memory, and disk are virtualized. Here, software and its dependencies are packaged. 

Containers Image Vulnerabilities

Here, an image may be patched without known vulnerabilities initially. But later, a vulnerability might have been discovered while the container image is no longer patched. In traditional systems, updates should be upstreamed in the images, and then deployed again, therefore, containers have vulnerabilities because of the older image version which is deployed.

Countermeasures - To get actionable and reliable results we need to use tools that have been designed to assess containers and to avoid container image misconfiguration, you need to validate the image configuration before deploying.

Embedded Malware and Clear Text Secrets

Container images are collections of files packaged together, having chances of malicious files getting added unintentionally or intentionally, that have the same effect as of the traditional systems.

Countermeasures - Continuous monitoring of all images for embedded malware with signature and behavioral detection.

Use of Untrusted Images

The use of untrusted images may lead teams to run container images from a third party without having validation, which results in the introduction of data leakage and malware.

Countermeasures - Should maintain and use only trusted images.

Registry Risks

1. Insecure connections to registries

If connections to registries are performed via insecure channels, it can lead to attacks. Configure development tools to connect over the encrypted medium to overcome the unsecured connection issue.

2. Insufficient authentication and authorization restrictions

Insufficient authentication and authorization will expose technical details of an app and loss of intellectual property. Authorization controls need to be enabled to avoid authentication and authorization risks.

Orchestrator Risks

1. Unbounded administrative access

Orchestrators should be given the required access with proper authorization to avoid unbounded administrative access.

2. Poorly separated inter-container network traffic

Here orchestrators need to configure separate network traffic as per the sensitivity levels in the virtual networks.

3. Orchestrator node trust

Orchestration should be configured securely for nodes and apps.

Container Risks

1. App vulnerabilities

Container aware tool is required that detects behavior and anomalies in the app to find and mitigate.

2. Rogue containers

A separate environment for development, test, production, and role-based access control is required to overcome this risk.

Host OS Risks

1. Large attack surface

The NIST SP 800-123 guide can be followed to minimize the attack surface.

2. Shared kernel

Here, libraries and packages are needed to run a web server or a database.

Read more about such containers and their vulnerabilities and securities from this blog by one of the best cybersecurity services companies in the USA, GAVS Technologies - https://www.gavstech.com/container-security/