As I noted in a previous article, the build environment is a key area on which organizations should focus their container security efforts. Companies don’t usually think of the build environment when it comes to securing their containers. But it’s critical that they do. Attackers can exploit development practices like Continuous Integration (CI) and Continuous Deployment (CD) to infiltrate the build environment, a setting which is typically less secure than production. There they can alter code or add new containers consisting of malware. To defend against these threats, organizations need to adopt security solutions that do not limit the usefulness of containers. They also need to focus on both elements of build pipeline security: application security, which involves testing code and containers for conformity with security and operational best practices; and tool security, which consists of evaluating the resources necessary for building and deploying applications. Below are four elements that incorporate all of the above-mentioned criteria. In so doing, they help organizations maintain build security as a critical component of their container security.
Secure Code Control
Source code control is commonplace, with Stash, Git and GitHub some of the most well-known variants. Personnel in security, operations and quality assurance frequently contribute code, tests and configuration data, so it’s important for organizations to take secure code control seriously. They can do so by running all traffic through a VPN and requiring two-factor authentication (2FA) if not token- or certificate-based authentication for administrative access.
Build Tools and Controllers
Tools like Bamboo and Jenkins give developers many different types of pre-, intra- and post-build options. But such flexibility comes at a cost to security. Fortunately, organizations can protect their tools and controllers by limiting access to them and fully segregating build controller systems on their own networks. They should also consider locking down configuration data as well as enabling built-in logging functions for added security.
Container Platform Security
Controller managers like Jenkins are powerful tools in that they control which applications can run. That being said, it’s in organizations’ best interest to limit access to specific container admin accounts and to build controller systems. If they’re running Docker, they should also segregate client access between development, test and production to control who can create containers and launch them into production.
Container Registry Security
When it comes to container registry security, developers make the common mistake of allowing anyone to add containers to the registry. This permission could allow an attacker to insert an insecure container into production or create compromised containers that are loaded with malware. To counter these threats, organizations need to make sure their registries require identity access management (IAM) credentials to limit who can submit a container.
Just One Element of Container Security
Securing the build environment is just one aspect of container security with which organizations should concern themselves. Tripwire’s eBook The Complete Guide to Container Security covers three additional areas. Download your copy today to learn more.
Mastering Security Configuration Management
Master Security Configuration Management with Tripwire's guide on best practices. This resource explores SCM's role in modern cybersecurity, reducing the attack surface, and achieving compliance with regulations. Gain practical insights for using SCM effectively in various environments.
