"Why your security team should be excited about containers" - John Downey, Security Lead at Braintree Twitter: @jtdowney AWS Chicago user group on Jan 17, 2018 on Evaluating and using ECS, Docker, and Kubernetes

1. Why your security team
should be excited about
containers
John Downey | @jtdowney

2. The views expressed in this
presentation are my own, and not
those of PayPal or any of its affiliates.

5. My tl;dr for security
1. Patch your stuff (language, libraries, OS, etc)
4 requires knowing what you run
2. Use strong unique passwords and turn on two-factor
4 requires a password manager

6. My tl;dr for security
1. Patch your stuff (language, libraries, OS, etc)
4 requires knowing what you run
2. Use strong unique passwords and turn on two-factor
4 requires a password manager

7. Dependency packaging

8. Docker will do to apt what apt did to tar. --Bryan Cantrill
4 All software dependencies in one spot
4 Images can change independent of each other
4 Nothing else on the system cares what is in the image

9. Common headaches
4 Your management tools are using the same
environment as your deploy code
4 Other software on the system uses the environment
4 You have to match the version used by a different
team

10. Supply chain/vendor
management

14. Where it breaks down
4 Monitoring: Teams don't know something is even
vulnerable
4 Discoverability: Teams don't even know they running
something at all

17. Explicit dependencies
4 If it is a dependency, you're putting it into the image
somehow
4 Creates a good checkpoint to take a look at that
dependency

18. Small units encourage
destruction/restarting

19. 4 linux kernel
4 glibc
4 openssl
4 imagemagick
4 ghostscript
4 libxml2

20. A lot of pain of patching is
dreading the restart

22. Restricted running
environment

23. 4 Have a clear demarcation of what is the apps
environment
4 Enable extra protections just for the app
4 SELinux, AppArmor, seccomp-bpf
4 Start containers with read-only filesystems

24. 4 Use tools to analyze what the app is doing
4 auditd
4 eBPF
4 sysdig

26. Infrastructure as code

27. Mysterious configurations
4 Why does this work on server02.us-west2 but not
server05.us-east2?
4 Why is this package this version
4 Did someone manually apt-get installed the
package?

28. Provenance
4 Who added this?
4 What were they working on?
4 What were they thinking?

29. Orchestration

31. Definition of what is
running

32. 4 What is running in your production environment
4 How many apps?
4 What version?
4 When were they deployed?
4 What dependencies do they have?

33. Higher level access control

34. 4 Adds a layer of indirection
4 You can use that indirection for access control
4 Previously needed access to the whole box
4 Now you just need API access

35. Questions
John Downey | @jtdowney