Container Security Basics: Introduction

What Does Container Security Really Mean?

Container adoption continues to accelerate. We see it in research across all impacted areas of IT, which is pretty much all of it. That containerized workloads will continue to consume enterprise workloads both on-premises and in the cloud is uncontested.

Nearly all (94%) organizations with containers in production are somewhat or very concerned about container security. More than half (60%) have experienced a container security incident in the prior 12 months according to Tripwire’s State of Container Security 2019. Over half (54%) of respondents selected “inadequate container security knowledge among teams” as their greatest security concern.

This may well be because containerization is not just about a packaging format. Containers alone provide very little benefit to organizations. The strength of containers is in the ability to deploy and manage them using orchestration systems. This is why they’ve existed for several decades but were never really adopted until orchestration offerings appeared on the scene.

Adoption accelerated when it became apparent that containers and orchestration were a natural fit with approaches like Agile and DevOps that encourage speed through the use of automated delivery and deployment pipelines.

It is reasonable, then, to assume that if one is deploying workloads in containers, they are also deploying an orchestration system that is part of a delivery (CI/CD) pipeline.

There are, then, three individual systems that must be considered when we start talking about container security: pipeline, orchestration, and workload.

Your security strategy for containers should also include all three. Leaving any one of them unevaluated leaves you open to a variety of risks, most of which can win you a spot you don’t want on a list or worse, in a headline you don’t want to read. That certainly makes it more difficult for organizations to ensure that teams have the appropriate security knowledge necessary.

That’s why I’ve teamed up with Sr. Test Engineer of Platform Security, Jordan Zebor, to bring you a series of blogs intended to help you get familiar with the basics so you can formulate a successful container security strategy. To do that, we’ll dig in deeper to each of the three components of container security:

1. Pipeline Security
   Your pipeline is the set of tools used to automate delivery of containerized workloads to the orchestration system. It may include custom Python scripts, Jenkins, GitHub, GitLab, and more.
   
   
2. Orchestration Security
   The orchestration system is used to manage and scale workloads. Most often Kubernetes but may be a Kubernetes-based system like RedHat OpenShift, AWS, Azure, Google, Mesos, or in some few cases, a custom system. In this series, we’ll be focusing on Kubernetes as it’s the most used orchestration option today.
   
   
3. Workload Security
   The security of the workload being deployed. Every workload is software and communicates with other workloads and may be accessible to the public. Increasingly this includes infrastructure and middleware.

Read the next blog in the series:
Container Security Basics: Pipeline