A Look at Container Security Through the Lens of DevOps

Containerization has revolutionized application development, deployment, and management – and for good reason. The ability to automatically wrap an application and its dependencies into a single, easily deployable package helps developers focus on what they do best: writing code.

Widely recognized as the go-to method to boost productivity and simplify the process, containerization keeps gaining traction with organizations looking to streamline their software development and delivery practices. According to Forrester, 71% of DevOps teams leverage containers and microservices to deliver applications. These facts warrant a closer look at container security, with a focus on how DevOps can provide a robust framework for the entire software engineering and delivery workflow.

A well-rounded DevOps approach can mitigate the potential pitfalls of containerization, and organizations that adopt containerization in DevOps can ensure that their data and systems stay safe in the face of increasingly prevalent cyber threats.

The Interplay of DevOps and Container Security

The fusion of development and operations processes, commonly known as DevOps, places emphasis on collaboration and automation as the crucial components of the software development lifecycle.

With continuous delivery and high software quality in place, organizations can bring out new solutions and features to market faster, but the big dilemma is to steer clear of a trade-off between speed and security. A Sysdig report from 2023 says a staggering 87% of container images that run in production come with critical or high-severity vulnerabilities. With this in mind, the need to fill the gap comes to the fore.

Understanding Container Risks

Just like any other type of deployment, containers aren’t immune to exploitation. While the concept of containerization itself addresses a good deal of security concerns, it also introduces new vulnerabilities. These include:

• Runtime threats: A running container can expose not only the container itself but also the underlying host operating system.
• Configuration errors: Misconfigurations can grant unauthorized access to containers and container orchestration platform data.
• Image vulnerabilities: The software running in the container can have security gaps that allow the attacker to first gain access to the container and, later, even to the host itself.

Proactive Security

While container security tools help strike that balance through image scanning, secrets management, runtime protection, and compliance, there’s a more proactive strategy. DevSecOps, an evolutionary security-centric extension of DevOps, reduces many vulnerabilities and configuration slip-ups early in the development pipeline.

Both DevSecOps and DevOps ultimately aim to enhance container security with the same principles and approaches:

• Shifting security left: When security is taken into account and implemented from the first stages of the project, it doesn’t become an afterthought but instead an integral part of the development process itself. This helps catch and fix security issues early, meaning that fewer of them end up in a production-ready deployment.
• Automation: Automating software vulnerability checks, monitoring running containers, and enforcing project and industry-relevant security practices can greatly lessen both the workload of the developers and the chances of something malicious slipping past the development or security teams.
• Increased collaboration: By breaking down information silos between different organizational units, it’s possible to enhance the overall security of the software development process and foster a culture of shared responsibility.

Strategies to Fortify Containerized Applications

While there are many steps to container security in the context of DevOps, there are a few universally held best practices that all developers should incorporate into their development lifecycle.

A primary practice is to secure container runtimes to the highest degree. Features like AppArmor and SELinux are subsystems (often referred to as security modules) of the Linux kernel that can be used to restrict what the containerized application is allowed to do at runtime, effectively pulling the plug on over-privileged execution and the ensuing exploitation scenarios.

Most software development does not happen from scratch but instead uses a variety of existing codebases and libraries, all of which are potential attack vectors. The use of verified software and container images for development reduces the risk of malicious code or vulnerabilities lurking in the final product. Yet, even official software can have security loopholes, so regular vulnerability scanning can help detect and fix issues before deployment.

Implementing the principle of least privilege isn’t restricted to just the division between user accounts and administrative accounts but also the actual processes and software running in the environment. As is the case with user accounts, least privilege means making sure that containers are run as non-root users whenever possible. This minimizes the damage an attacker could cause after gaining a foothold in a container.

It’s also hard to overestimate the importance of actively monitoring and responding to security threats after the deployment is complete. Information systems do not exist in a vacuum, so making sure that they are running correctly and staying healthy is imperative for the performance of the whole environment. This can be achieved with a variety of monitoring and logging tools that collect and analyze container logs and metrics, making it easier to implement a response plan and quickly address issues as they arise in the environment.

DevOps Is a Stepping Stone to a Safe Container Ecosystem

Security as an overarching concept is a complex set of ever-changing challenges, and while containerization does help remedy some issues at a fundamental level, it also introduces a host of new attack vectors.

Security has to be integrated into the fabric of software development at early stages, and this is where DevOps comes into play. Organizations can get a lot of mileage out of automation tools to significantly reduce the risks associated with deploying and running containers, but the onus is on developers to keep it that way throughout the software engineering lifecycle.

Container security is not a “plug-and-play” feature but rather an ongoing process that involves shifting-left strategies in continuous development and integration, monitoring and regularly updating the existing resources, and responding swiftly to newly detected threats. DevOps best practices can harden the security of your organization’s container environment, both on-premises and in the cloud.

About the Author:

David Balaban is a cybersecurity analyst with two decades of track record in malware research and antivirus software evaluation. David runs Privacy-PC.com and MacSecurity.net projects that present expert opinions on contemporary information security matters, including social engineering, malware, penetration testing, threat intelligence, online privacy, and white hat hacking. David has a solid malware troubleshooting background, with a recent focus on ransomware countermeasures.

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor and do not necessarily reflect those of Tripwire.