Docker containers are the most popular containerisation technology. Used properly can increase level of security (in comparison to running application directly on the host). On the other hand some misconfigurations can lead to downgrade level of security or even introduce new vulnerabilities.

1. Container Security Management
Suresh Rupasinghe
Associate Tech Lead - WSO2

2. Cloud Native Technologies

3. What is a Container?
A standardized unit of software
● Lightweight
● Standalone
Cloud Native Security
Container Runtimes:
● Docker
● rkt

4. Comparing Containers and Virtual Machines
Container Virtual Machine

5. What is Kubernetes?
K8s is an open-source system
for automating deployment,
scaling, and management of
containerized applications.
Cloud Native Security

6. Traditional Approach vs. Modern Application Approach
Cloud Native Security

7. Demo

8. Containers & K8s Attack Vectors
Poisoned ImagesKernel Attack Denial of Service
Cloud Native Security
Container Breakouts Sniffing Secrets

9. The Attack Kill Chain
1. Recon
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command & Control
7. Exfiltration
Cloud Native Security

10. Recent Attacks…!!!
Cloud Native Security

11. Container Security Stack
Container Security
Infrastructure
Pod Security Policies
Network Filtering
Secrets Management
Build
Code Analysis
Image Scanning
Deployment Check
Runtime
Anomaly Detection
Forensics
Run-Time Vulnerability Scanning
Cloud Native Security

12. Securing CI/CD Pipeline

13. Securing CI/CD Pipeline
Cloud Native Security
Docker
Hub

14. Sample Dockerfile & K8s Deployment file
Cloud Native Security

15. Securing CI/CD Pipeline
1. Image Scanning
● Clair by CoreOS
● Anchore
2. Code Analysis
3. Deployment Checks
● Kubesec.io
Cloud Native SecurityCloud Native Security

16. Infrastructure Layer Security

17. Infrastructure Layer Security
1. Pod Security Policies
● Kubernetes Pod Security Policy
Advisor
2. Network Filtering
● Cilium
Cloud Native SecurityCloud Native Security

18. Run-time Security

19. Run-time Security
1. Anomalous Behavior Detection
■ Falco
2. Runtime Vulnerability Scanning
3. Security Auditing
Cloud Native Security

20. OWASP Best Practices
RULE #0 - Keep Host and Docker up to date
RULE #1 - Do not expose the Docker daemon socket
RULE #2 - Set a user
RULE #3 - Limit capabilities (Grant only specific capabilities,
needed by a container)
RULE #4 - Add –no-new-privileges flag
Cloud Native Security

21. OWASP Best Practices -
RULE #5 - Disable inter-container communication (--icc=false)
RULE #6- Use Linux Security Module (seccomp, AppArmor, or SELinux)
RULE #7 - Limit resources (memory, CPU, file descriptors, processes, restarts)
RULE #8 - Set filesystem and volumes to read-only
RULE #9 - Use static analysis tools
RULE #10 - Set the logging level to at least INFO
Cloud Native Security

22. Secret Management
Kubernetes Level
● Kubernetes secret
● HashiCorp Vault
Source Code Level
● Helm Secrets
● Sealed Secrets
Cloud Native Security

23. References:
● https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1---do-n
ot-expose-the-docker-daemon-socket-even-to-the-containers
● https://www.youtube.com/channel/UCvqbFHwN-nwalWPjPUKpvTA
● https://istio.io/
● https://www.youtube.com/watch?v=Jbqxsli2tRw
● https://www.youtube.com/watch?v=15bsTualHnA
● https://www.youtube.com/watch?v=Uocf67aD5QQ
● https://www.openpolicyagent.org/
● https://spiffe.io/

24. Q&A

25. THANK YOU