Docker container webinar final

© 2019 ControlCase All Rights Reserved
Docker and Container Compliance
Your IT Compliance Partner –
Go Beyond the Checklist

Our Agenda 2
4
2
3
Your IT Compliance
Partner –
Go beyond the
checklist
ControlCase Introduction
About Docker and Container
Docker/ Container Compliance
ControlCase Solution
Why ControlCase5
1

ControlCase Introduction1

ControlCase Snapshot 4
Certification and ContinuousCompliance Services
Go beyond the auditor’s checklist to:
Dramatically cut the time, cost and burden from becoming certified and
maintaining IT compliance
• Demonstrate compliance more efficiently
and cost effectively (cost certainty)
• Improve efficiencies
• Do more with less resources and gain
compliance peace of mind
• Free up your internal resources to focus
on their priorities
• Offload much of the compliance burden
to a trusted compliance partner
1000+
Clients
300+
Security Experts
10,000+
IT Security Certifications

Solution 5
Certification and Continuous Compliance Services
Automation
-DrivenSkyCAM
Partnership
Approach
IT Certification
Services
Continuous Compliance
Services
“I’ve worked on both sides of
auditing. I have not seen any
other firm deliver the same
product and service with the
same value. No other firm
provides that continuous
improvement and the level of
detail and responsiveness.”
Security and Compliance
Manager, Data Center

Certification Services 6
OneAudit – Collect Once, Certify Many
PCI DSS ISO 27001 &
27002
SOC 1, SOC 2, SOC 3,
& SOC for Cybersecurity HITRUST CSF
HIPAA PCI P2PE GDPR NIST 800-53
PCI PIN PCI PA-DSS FedRAMP PCI 3DS
“You have 27 seconds to make a
first impression. And after our
initial meeting, it became clear
that they were more interested
in helping our business and
building a relationship, not just
getting the business.”
Sr. Director, Information Risk &
Compliance, Large Merchant
Automation-
DrivenSkyCAM
Partnership
Approach
IT Certification
Services
Services

About Docker and Container2

What is Container 8
Containerization refers to an operating
system feature in which the kernel allows the
existence of multiple isolated user-space
instances.
Popular Containerization Solutions:
1. AWS ECS
2. Google Kubernetes
3. Open Source Docker Technology

Docker and AWS ECS 9
Docker is an open platform for containerization and can
be used to deploy containers for developers and
sysadmins
Amazon ECS is a highly scalable, high-performance
container orchestration service to run Docker containers on
the AWS cloud.
Google Kubernetes Engine (GKE) is a managed production
ready environment for deploying containerized applications

Recap of Terminology
1. Containerization is a “feature”
2. Docker is an “open source software” that enables the
containerization feature
3. ECS is “Amazon’s implementation” of the
4. GKE is “Google’s implementation” of the
10

Hosting Models 11
1. Physical Client Hosted
2. Datacenter Managed Service
3. Cloud Service Client hosted
4. Cloud hosted Container Service
Providers

Docker/ Container Compliance3

Compliance from Container Context 13
Physical Client
Hosted
Datacenter Managed
Service
Cloud Client Hosted Service
Cloud Container Service
Providers
Hardware Client Responsibility Provider Responsibility Provider Responsibility Provider Responsibility
OS Layer Client Responsibility Client Responsibility Client Responsibility Provider Responsibility
Container Layer Client Responsibility Client Responsibility Client Responsibility Client Responsibility
Application
Layer
Client Responsibility Client Responsibility Client Responsibility Client Responsibility
Compliance Responsibility Matrix in case of Different Container Hosting Models

Compliance Responsibility Matrix using Amazon/Google Clouds 14
Compliance Area Responsibility
Scoping Customer
Network Shared
Configuration Management Customer
Data Encryption at rest Customer
Data Encryption in transit Customer
Anti-Malware Customer
Application Security Customer
Logical Access Customer
Physical Security AWS
Logging and Monitoring Customer
Security Testing Customer
Policies and Procedures, Risk
Assessment, Third Party Management,
Governance and Compliance and
Incident Response
Customer

Top 10 Best Practices for Compliance 15
Number Technology Difference Compliance Best Practice
1 Traditional development practices, patching
techniques, and system upgrade processes
may not apply to a containerized environment
Ensure developers are trained in secure practices to
develop, run, test and support applications using
container technologies
2 When using a container-specific host OS,
attack surfaces are typically much smaller
than they would be with a general-purpose
host OS, so there are fewer opportunities to
attack and compromise a container-specific
host OS.
Whenever possible, you should use container-specific
host OSs to reduce their risk. At the same time it is
important to note that container-specific host OSs will still
have vulnerabilities over time that require remediation.
3 Segmenting containers by purpose, sensitivity,
and threat posture provides additional defense
in depth.
Group containers in this manner and you will make it
more difficult for an attacker who compromises one of
the groups to expand that compromise to other groups.
4 Weak orchestrator configurations can increase
risk due to
- Unauthorized hosts joining the cluster
- Single point of failure
- Unencrypted inter process
communications
Harden orchestrator configurations
5 Traditional tools are often unable to detect
vulnerabilities within containers, leading to a
false sense of safety
Adopt tools and processes to validate and enforce
compliance with secure configuration best practices for
images. This should include having centralized reporting
and monitoring of the compliance state of each image,
and preventing non-compliant images from being run.

Top 10 Best Practices for Compliance 16
Numbe
r
Technology Difference Compliance Best Practice
6 Network and monitoring tools are not
necessarily all container aware.
Container-aware network monitoring and filtering would detect
anomalous connections to other containers during the attempt
to map other systems.
7 Process and file system activity is more
interrelated than traditional segmented
environments.
The usage of mandatory access control capabilities can
provide additional barriers to ensure that process and file
system activity is still segmented within the defined boundaries.
8 Segmentation of workloads ensures that
the scope of the compromise would be
limited to apps of a common sensitivity
level that are sharing the host. For
example, a compromised runtime on a host
only running web apps would not impact
runtimes on other hosts running containers
for financial apps.
Segment workloads by type of applications and sensitivity of
data
9 Traditional tools for software management
(including management of images) do not
necessarily work in a containerized
environment.
Ensuring software is implemented that allows only vetted,
tested, validated, and digitally signed images are allowed to be
uploaded to an organization’s registries.
10 Traditional environment segregation
techniques may not work.
You should institute separate environments for development,
test, production, and other scenarios, each with specific
controls to provide role-based access control for container
deployment and management activities.

Top 10 Best Practices for Compliance Summary
Container Compliance - Best Practices
1. Make developers aware to support the new way of developing, running, and
supporting applications made possible by containers.
2. Use container-specific host OSs
3. Group containers with the same purpose, sensitivity, and threat posture on a
single host OS
4. Harden Orchestrator configurations
5. Use container-specific vulnerability management tools
6. Implementing container-aware network, process monitoring and filtering and
Malware filtering
7. Use of mandatory access control
8. Segmentation of workloads
9. Only vetted, tested, validated, and digitally signed images upload and run
10. Separate environments for development, test, production, and other scenarios
17

ControlCase Compliance Solutions for Docker/Containers4

Achieving Compliance in Cloud 19
Compliance Area Responsibility ControlCase
Solutions
Scoping Customer
Network Shared
Vulnerability
Scanning
Configuration Management Customer Config Scanning
Data Encryption at rest Customer
Data Encryption in transit Customer
Anti-Malware Customer
Application Security Customer
Application
Scanning
Logical Access Customer
Physical Security AWS
Logging and Monitoring Customer
Security Testing Customer Pen Testing
Policies and Procedures, Risk
Assessment, Third Party Management,
Governance and Compliance
Customer Policy Manager

ControlCase Cybersecurity Solutions 20

Automation-driven 21
SkyCAM IT Compliance Portal
Automation-driven certification and continuous compliance
SkyCAM
IT
Compliance
Portal
• Cut evidence collection time up to
70%
• In the cloud or on-prem
• Go beyond monitoring and
alerting to predict, prioritize
and remediate compliance risks
before they become security
threats
Automated
Evidence
Collection
Real-time
Certification
Dashboard
Predictive
Continuous
Compliance
(AI-powered)
• Stay on top of progress with
visibility into your certification
process with drill down capability
GRC Platform
Integration
• Integrate and extend capability of
GRC platforms
Automation-
DrivenSkyCAM
Partnership
Approach
IT Certification
Services
Services

Why ControlCase5

ControlCase Certification Outcomes 23
“It’s a challenge keeping up with the
changing compliance landscape. Given
that we had GDPR and now the
California data privacy law, not to
mention HIPAA and others, there are a
lot of regulations and frameworks to
keep up with and a lot of time spent
preparing for audits. That puts a lot of
overhead and strain on me and my
team. We don’t just don’t have the
expertise or time to keep up.
Before
ControlCase
“We cut audit prep time by 70% using
ConrolCase. It was their partner approach to us;
a combination of their expertise, their
responsiveness and automation. They brought us
great ideas on how to streamline our process,
and we were able to take advantage of
automated data collection. And, their IT
Compliance Portal gave us visibility throughout
the entire process.
Another thing - We don’t look at compliance as a
once a year event, and now, with ControlCase’s
Continuous Compliance services, we have the
visibility into what’s in compliance and what’s not
all year long. We can quickly remediate an issue
before it becomes a security threat.”
With ControlCase
Cut audit prep time by 70%

Summary – Why ControlCase 24
“They provide excellent service, expertise and technology. And, the
visibility into my compliance throughout the year and during the audit
process provide a lot of value to us.”
Dir. of Compliance, SaaS company
Your IT Compliance Partner –
Go beyond the auditor’s checklist
Partnership
Approach
SkyCAM
IT
Compliance
Portal
Automation
driven Continuous Compliance
Services

Email
contact@controlcase.com
Telephone
Americas +1.703-483-6383
India: +91.22.50323006
Social Media
Conection Suport
www.facebook.com/user
www.linkin.com/user
Visit our website
www.controlcase.com
THANK YOU FOR THE OPPORTUNITY TO
CONTRIBUTE TO YOUR
IT COMPLIANCE PROGRAM

Docker container webinar final

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Docker container webinar final

Similar to Docker container webinar final (20)

More from ControlCase

More from ControlCase (16)

Recently uploaded

Recently uploaded (20)

Docker container webinar final

Editor's Notes