Secrets to a Stronger Strategy For

Container Security
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 2

Table of Contents
3 The fellowship of containers, an emerging developers’ community

4 Set permissions for users and system resources

6 Create an action plan based on log monitoring and ids data

8 Consider container security in the larger context

9 Meet your secret agent, alert logic

10 Deploy today through AWS marketplace

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 3

The Fellowship Of Containers, an Emerging

Developers’ Community
In recent years, we have seen container adoption continue to grow as more and more organizations
look to transition away from virtual machines to microservices-based architectures. Containers
provide increased efficiency, portability, and scalability. Today, orchestration platforms like Docker
and Kubernetes are some of the most widely adopted technologies because of the central role

58%
they play in developing with containers.

Compared to virtual machines, containers have a smaller footprint which means a smaller
attack surface. They also provide an additional layer of security through their ability to isolate
applications. However, this doesn’t mean that your containerized environment is not susceptible
to malicious attacks between containers or within the shared resources of the underlying host. of developers report
A strong container security strategy starts with a 360-degree awareness of the container and that their companies
how it interacts with its environment and ends up as automated governance policies woven into use containers or plan
the Continuous Integration/Continuous Delivery (CI/CD) pipeline. Planning a container security to use containers in the
strategy for the first time can feel a little like trial-and-error. And while DevOps is all about iterating next 12 months.
to get better, security isn’t something you should take a chance on.

Setting up container security

shouldn’t feel mysterious

Our container experts have developed, tested, and refined eight best practices for security in your environment. In the spirit of the
fellowship of containers, we are passing along these not-so-secret practices to you:

› Set permissions for users and system resources

› Create an action plan based on log monitoring and IDS data
› Plan for maximum portability
› Take care of your host
› Join a community forum
› Perform regular backups
› Only use trusted software
› Think big picture security

Read on for more explanation of these practices and some tips for how your Amazon Web Services (AWS) environment can help.

And welcome to the fellowship of containers.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 4

Set Who is
Permissions Accessing
For Users Your
And System Containers?
Resources
Two of the biggest differences between Set least-privilege access rules: As with any software
containers and other virtualized assets that system you run, it’s a good idea to use the lowest
affect your security strategy are 1) many privileges possible for your containers, as well as the
containers share a single operating system binaries and libraries within them. This helps prevent
(OS) and 2) containers ship with fully stocked privilege escalation and wrongful data access and all
libraries already built in. These are important kinds of bad habits.
because they create new entry points for
Tip: AWS Identity and Access Management
security threats. In the case of the shared
(IAM) offers a shortcut to implementing least
OS, or host, a single OS attack will likely
privilege restrictions based on AWS best practices
affect many connected containers. Likewise,
for leveraging roles established within one service
a library or binary can be used as a point of
to another. IAM policies can be automatically
entry between containers through privilege
applied based on a task definition that you set when
escalation.
launching the container and attached to either users
Thankfully, you can mitigate many of these or roles.
risks by thinking about your user permissions
Turn off root privileges: We recommend setting up
policies and how you allocate shared
a non-root user and making it the default in your
resources from the get-go. Here are detailed
container configuration. For the most part, Docker
steps to help you when you’re setting up your
and Kubernetes subprocesses do not run with root
containers for use in your DevOps pipelines. If
privileges out of the box, however, it never hurts to
you’re already in production, it’s not too late
double check. And when you absolutely must use the
to use these steps for future iterations of your
root account for container-based actions, be mindful
microservices.
of how you use it.

Tip: Amazon Elastic Container Service (Amazon

ECS) provides a configuration flag that lets you
choose the user you want for any task when you
launch. Flag your non-root user.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 5

Are your containers How does your host

talking behind your affect your security?
back?
Segregate containers: You can lower your overall Limit host resources by container: A denial of
risk exposure by establishing smaller groups service (DOS) attack on a container could deplete
of containers that don’t talk to one another. its host’s resources and consequently shut down the
Depending on your environment, you might other containers supported by it. By using container
segregate containers by host, by the role they play orchestration frameworks like Docker Swarm and
(i.e. web server, database, customers), or based on Kubernetes, you can limit CPU, RAM, and ulimits for
their risk of exposure—so those most susceptible each container, which can help reduce DOS attacks and
are grouped together. general resource hogging.

Tip: You can set Amazon ECS to perpetuate Tip: Amazon ECS allows you to configure CPU, RAM,
the segregation that you establish in your initial and ulimits to help you automate governance.
configuration.
Restrict kernel capabilities: Set limits on what the kernel
Disable inter-container communication:
can access by task.
Another way to cut down on inter-container
communication (icc)is to disable it.
Tip: With Amazon ECS, kernel capabilities are limited
by the service and can be set per task.
Tip: Amazon ECS lets you use a link flag to
connect containers and control communications
between them. You can set it up by marking docker Validate your host before launching: One of the
flags “–icc=false” and “–iptables=true”. biggest challenges in SecOps is incorporating repeatable
container governance policies into your pipeline. You can
Restrict network chatter: Of course, security use an automated service like Docker Bench to validate
threats can be transmitted between containers your container host against security best practices.
through your network, too. Be sure to consider your
network controls. Tip: In an AWS environment, you can use AWS
Lambda to build Docker Bench into your CI/CD pipeline so
Tip: Amazon ECS offers network control it automatically calls the service whenever you launch
through the container control for Elastic Network a new host.
Interface (ENI). You can use the ENI to customize
port configurations for your use case. Furthermore, Control file system access: There’s no reason for
AWS App Mesh allows you to standardize network the data in your file systems to be accessible to all
communication by giving you visibility into how your containers and users, but it is unless you specify
things are communicating on an application level. otherwise. By configuring the file systems directory default
to read only, you can make it so that only the host can
access the data. SELinux provides a default for docker
that enforces the read/execute to /usr.

Tip: Use the Amazon ECS configuration flag to turn

on –read-only.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 6

Which resources do you need in your container?

Remove static libraries and binaries: Containers ship Store secrets separately: As a rule of life and app
prepopulated with libraries and binaries you’ll never need building, secrets are necessary—and messy. Instead
to use. These can be used as a point of entry if you’re of embedding your secrets in your app configuration
not careful. By turning on the SECCOMP modular that’s directly, which could compromise the security of other
built into the Linux kernel, you can limit system calls and apps that use similar secrets, you can store secrets
enable least privilege access: separately.

Tip: Remove setuid/setgid binaries from images Tip: AWS Systems Manager Parameter Store will
store and encrypt your secrets separately from your app
and its container. Systems Manager Parameter Store
Tip: Debian ‘defanged’ image Dockerfile
is fully integrated with AWS which means you can use
configuration (removes access to those binaries)
IAM roles to call the System Manager Parameter Store to
retrieve the secret for the system task (i.e.
logging into the server) without embedding the secret into
the app. At the application level, AWS Secrets Manager
allows you to store secrets that manage application and
database passwords.

Create an action plan

based on log monitoring
and ids data
One of the key tenets of any security strategy is to keep a close eye on
what’s going on in your environment and have a plan of action for unwanted
interruptions.

The same rules apply to your container environment. That’s where IDS and log
monitoring come in.An intrusion detection system (IDS) gives you a holistic view
of network traffic between your containers. It provides alerts on malicious traffic
to keep you informed of activity. Logs, on the other hand, record forensic data
you can use to get a picture of what is going on at the system level.

By using both of these together, you get a much better understanding about
what is happening within a single container and between multiple containers.
Not only is this important from a security perspective, but also a network and
general software perspective.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 7

How well do you Are you using the data

understand your traffic? from your logs effectively?
Map out container traffic: It’s important to start with Output logs to a centralized location: If your IDS
a good understanding of the traffic you expect to detects a problem, you can use your log data
see traveling North/South (from container to its host) to understand what’s happening inside the
and East/West (between containers themselves) to environment and to perform forensics. Of course,
help you better detect anomalies. You can use your logs can only help if you can get the data. You’ll
network architecture or a 3rd party tool to help you want to configure containers so they output logs to
map out the network pattern for expected behavior. a centralized location, ideally a separate container,
Based on your map, it’s a good idea to disable inter- where you can use a log management system
container communication (icc) that is not specifically to help you make sense of them. For continuous
needed (see “Are your containers talking behind your logging on docker you may have to configure the
back?” for guidance). default logging driver to write logs to your desired
location (/var/log/, /var/ log/docker/).
Monitor your traffic: Once you know what expected
traffic looks like, you need a mechanism to monitor Tip: AWS S3 is an object storage service that can
actual traffic so you can spot traffic mishaps. That’s be used to store the logs. AWS CloudWatch Logs is a
where IDS comes in. When evaluating your options log service to which most AWS services can output
for a 3rd party IDS solution, consider whether logs. CloudWatch Logs provides a single view over
you need an integrated or side car solution. In an all the different logs from your container instances in
integrated solution, you run a container on the host one convenient location, allowing you to gain deeper
that has access to ETH 0 bridge and can see all the contextual evidence on the findings, manipulate the
traffic from the inside the system. With a side car data, and take action on it.
solution, the IDS runs outside of the system and gets
fed information on the containers. This often comes
in the form of log correlation.

Tip: AWS CloudWatch allows you to configure

your container instances to send log information to
CloudWatch Logs. Here you can view all the different
logs from your container instances in one convenient
location.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 8

Consider Container Apply Security Best

Security In The Larger Practices You Already Use
Context To Containers
A lot of the differentiated work that’s involved with Perform regular backups: This one goes hand and
creating a strong security strategy for your container hand with the previous best practices. Always do regular
environment, versus other virtualized assets, comes backups and backups at important time intervals, such
down to setting permissions, limiting resources, as before updates or any major development changes.
and monitoring systems. However, there are other Regular automatic updates also help in the case of
considerations unique to containers and general to disaster recovery.
development environments that you need to account
for as well. While guidance for those matters tends to be Only use trusted software: It may be tempting to (after
less prescriptive, that doesn’t make them less important. reading a good article on a random blog or receiving a
link) pull an image from an unknown repository. Don’t. If
you can’t find the images from a trusted source there’s

Start Your Container

probably a good reason.

Think big picture security: A strong security strategy

Strategy With Security In requires a thorough understanding of how everything

Mind works together. Whether you’re using containers

for development or running production servers for
Join a community forum: The fellowship of containers ecommerce, it’s a good idea to start by outlining your
runs wide and deep. Joining a community forum is a goals and security posture. You can do that by creating
great way to tap into all the expertise out there. Some an architecture diagram that lists how everything
popular forums include Docker, AWS, Kubernetes, operates together and using that hierarchy to apply the
as well as independent forums built around these model of least privilege. Furthermore, you can implement
products. pre-production scanning of your containers as part of
your CI/CD pipeline. Creating a Wordflow diagram makes
Plan for maximum portability: Your container’s it easier to understand the process and automate the
portability is one of its main attributes, so make sure scanning where appropriate. (Note: Alert Logic products
your security strategy (and your application itself) works include scanning capablities you can build into this
across multiple platforms, in hybrid environments, as process.)
well as on-premises.

Take care of your host: A not-so-secret secret is “a

healthy host is a happy host,” meaning you will save
yourself a lot of heartache and work if you remember to
keep your main host up to date. A great way to do that
is automate regular patching using AWS Lambda and
governance policies using Docker Bench as part of your
CI/CD pipeline. Alternatively, you can use a managed
container service, like AWS Fargate, to take care of the
host for you.

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 9

Meet Your Secret Agent, Alert Logic

At Alert Logic, our contingent of the Alert Logic Essentials uses SIEMless Alert Logic Professional includes all
fellowship of containers has created Threat Management™ to help you the benefits of Essentials plus these
services specifically designed to help gain visibility into your environments, capabilities, and more:
you build a strong container security identify appropriate remediation
strategy without requiring you to get steps, and block attacks through a
24/7 Incident Monitoring &
your PhD in it. combination of machine-learning
Management
and real-time behavior analysis. Security Analytics & Threat
All of our offerings employ our AWS
cloud-native security platform,
Intelligence
Asset Discovery
threat intelligence with prioritized Log Collection and Monitoring
remediation recommendations, Vulnerability Scanning
and use our 24/7 expert defender Intrusion Detection System
Cloud Configuration Checks
team. Our most popular offering,
Security Event Insights and
Alert Logic Professional, includes a Extended Endpoint Protection Analysis
fully managed service in which our
experts monitor your environment Threat Risk Index Office 365 Log Collection &
24/7. Search
Compliance Scanning And
Unlike many of the other solutions Reporting Cloud Vendor Security
available today, ours has been Integrations
developed to work with AWS native Support For Multiple
User Behavior Anomaly
architecture as well as other cloud Environments
and on-premises systems. We are
Detection
certified as an AWS Container 24/7 Email And Phone
Anti-Virus Integration
Competency partner. Support

AlertLogic.com
 S E C R E TS TO A S T RO N G E R S T R AT E GY FO R CO N TA I N E R S E C U R I T Y 10

Lock In Your
Container Strategy
With Alert Logic
Subscribe to Alert Logic Managed Threat
Detection on AWS Marketplace to get started
fast.

SIGN UP NOW

© 2020 Alert Logic, Inc. The information contained in this document is confidential and only for the use of the intended
recipient. You may not publish or redistribute this document without advance permission from Alert Logic