Do You Know What’s Hiding in Your Containers?

Between the growth of cloud-native applications and the demands of faster application delivery, the use of containers is widely predicted to continue to increase. In fact, a recent study conducted by Enterprise Strategy Group (ESG) for CrowdStrike, “The Maturation of Cloud-native Security: Securing Modern Apps and Infrastructure,” found that container adoption has grown 70% over the last two years, and there is projected to be a 50% increase in cloud-resident workloads over the next 24 months. This increase is also driving the need for container security and orchestration solutions. Like any other technology deployed in production environments, containers have to be properly configured, provisioned, secured and monitored. That last piece — monitoring — is vital. Many containers are short-lived, and the sheer number of them creates challenges around visibility. Obtaining visibility is also complicated due to the scope of the DevOps environment and a lack of integration between disparate tools. To properly enable the use of containers, organizations need to be able to extend security from the base images being used all the way to production.

A False Sense of Safety

Containers do not magically make everything secure — yet organizations often act as though they do. It is not uncommon, for example, for images to run with root privileges — which in many cases is likely a violation of the principle of least privilege. Then there is the fact that developers often utilize code from third-party libraries. Not all of this code, unfortunately, is secure. For example, in April 2020, Microsoft reported that Azure Security Center had uncovered of a widespread cryptocurrency mining attack against Kubernetes clusters caused by containers running an image laced with

XMRig, a very popular open-source Monero miner. Older images may contain vulnerabilities that can be exploited by attackers. If one container is compromised, it can serve as a gateway to a deeper compromise into the environment. While immutability provides benefits for automation and deployment, it also makes it vital to catch vulnerabilities early in the CI/CD process. Attempting to bolt on security later will only cause organizations to miss vulnerabilities that could have been caught prior to the containers being deployed.