Container adoption continues to accelerate. We see it in research across all impacted areas of IT, which is pretty much all of it. That containerized workloads will continue to consume enterprise workloads both on-premises and in the cloud is uncontested.
Nearly all (94%) organizations with containers in production are somewhat or very concerned about container security. More than half (60%) have experienced a container security incident in the prior 12 months according to Tripwire’s State of Container Security 2019. Over half (54%) of respondents selected “inadequate container security knowledge among teams” as their greatest security concern.
This may well be because containerization is not just about a packaging format. Containers alone provide very little benefit to organizations. The strength of containers is in the ability to deploy and manage them using orchestration systems. This is why they’ve existed for several decades but were never really adopted until orchestration offerings appeared on the scene.
Adoption accelerated when it became apparent that containers and orchestration were a natural fit with approaches like Agile and DevOps that encourage speed through the use of automated delivery and deployment pipelines.
It is reasonable, then, to assume that if one is deploying workloads in containers, they are also deploying an orchestration system that is part of a delivery (CI/CD) pipeline.
There are, then, three individual systems that must be considered when we start talking about container security: pipeline, orchestration, and workload.
Your security strategy for containers should also include all three. Leaving any one of them unevaluated leaves you open to a variety of risks, most of which can win you a spot you don’t want on a list or worse, in a headline you don’t want to read. That certainly makes it more difficult for organizations to ensure that teams have the appropriate security knowledge necessary.
That’s why I’ve teamed up with Sr. Test Engineer of Platform Security, Jordan Zebor, to bring you a series of blogs intended to help you get familiar with the basics so you can formulate a successful container security strategy. To do that, we’ll dig in deeper to each of the three components of container security: