docker security - continuous container security
Post on 21-Jan-2018
2.382 Views
Preview:
TRANSCRIPT
DOCKER SECURITY CONTINUOUS CONTAINER SECURITYContainer Threat Landscape & Network Security
Dieter Reuterdieter.reuter@bee42.com@Quintus23M
Container Threat Landscape
Nor
th-S
outh
East-WestHost
Containers Containers
Host
Ransomware
DDoS
Kernel ‘Dirty Cow’
Privilege Escalations
Breakouts
DNS AttacksApplication Attacks
Docker daemon attack
Port scanning
Virus injection
Data stealing
Lateral movement
XSS, SQL injection Container phone home
Resource consumption
Heap corruption
Buffer overflow
Zero-day attacks
Malware
Unauthorized access
Image back doors
Continuous Container Security
Build Ship Run
Pre-Deployment Run-Time✓ Image Signing, e.g. Content Trust
✓ User Access Controls, e.g. Docker Trusted Registry
✓ Code Analysis
✓ Container Hardening
✓ Image Scanning
✓ Host OS Security✓ Kernel Security
✓ SELinux✓ AppArmour✓ Seccomp
✓ Access Controls✓ Secrets Management
✓ Container Network Security
Inspect - Protect - Monitor - Scale
Security Rules Can’t Keep Up
Container Network Security
▪ Inspect Network
▪ Protect - Containers - Container Hosts
▪ Monitor & Visualize
▪ Automate & Scale
Inspect Network Traffic
▪ Best Security Detection Point▪ North-South and East-West▪ Container Connections and Packets
- Layer 7, Application Protocol and Payload
▪ Traffic between Containers- Intra-Host, Inter-Host
Challenge – Dynamic Workloads
Containers
Host
Protect Application Containers
▪ Detect Violations▪ Detect Threats
- DDoS, XSS, DNS, SSL▪ Scan for Vulnerabilities▪ Respond
- Connection Blocking- Container Quarantine- Alert & Log
Challenge – Accuracy, False Positives
Containers
Host
Breakout
AttackPhone HomeLateral Spread
Vulnerable Container
Protect Container Hosts
▪ Implement Pre-Deployment Security- Kernel, Docker Engine
▪ Scan for Vulnerabilities▪ Detect Privilege Escalations▪ Perform Security Auditing
- CIS Benchmark
Challenge – Real-Time Host Monitoring
Containers
Host
Vulnerable Host
Host Breakout
Monitor & Visualize
▪ Container Network Connections▪ Application ‘Stacks’▪ Security Policy and Violations▪ Detailed Event Logging▪ Packet Capture
Challenge – Large & Complex Deployments
Automate & Scale
▪ Security Must Be Container Native- Integrated with Orchestration Platforms- Compatible (Agnostic) to Network Overlays &
Plug-Ins▪ Swarm, Flannel, Calico, Rancher, Weave, …
▪ Then Automate- Security Policy, Visualization
▪ And Scale- Constant Adaptation
Challenge – Rapid Network/Platform Evolution
Demo
▪ Deploy NeuVector onto running apps▪ Discover application behaviour▪ Auto-create security policy▪ Detect violations▪ Protect containers▪ Scan for vulnerabilities
Demo: Micro-Segmentation
▪ App#1: 3 tier Node.js web application (5 containers)▪ App#2: 2 tier WordPress application (2 containers)
- Automatic segmentation: Discover ! Monitor ! Protect
Host #2
NeuVector Enforcer(Security Service )
Node .js #1(web server )
Node .js #2(web server )
Node .js #3(web server )
Host #1
NeuVector AllInOne(Security Service )
Nginx(Load Balancer )
Redis(Database Service )
Wordpress(web server )
MySQL(Database Service )
External or Internet
Continuous Container Security Reference
Build Ship Run
Pre-Deployment Run-Time✓ Image Signing, e.g. Content Trust
✓ User Access Controls, e.g. Docker Trusted Registry
✓ Code Analysis
✓ Container Hardening
✓ Image Scanning
✓ Host OS Security✓ CIS Benchmark
✓ Kernel security✓ SELinux✓ AppArmour✓ Seccomp
✓ Secure Docker Engine✓ Access Controls✓ Secrets Management✓ TLS Encryption✓ Auditing w/ Docker
Bench✓ Orchestration –
Network, Security, Containers
✓ Network Inspection & Visualization
✓ Run-Time Vulnerability Scanning
✓ Process Monitoring✓ Threat Detection✓ Privilege Escalation Detection✓ Container Quarantine✓ Layer 7-based Application
Isolation✓ Packet Capture & Event
Logging
Container Security
GUIDE
THANK YOUFor more information contact me via Email dieter.reuter@bee42.com, or Twitter @Quintus23M
Slides kindly borrowed from https://neuvector.com
top related