Best Practices to Secure Application Containers and ... · shared Operating System. •Application Containers are isolated from other Application Containers and share the resources

© c2labs.com

Anil KarmelCo-Founder and CEO, C2 LabsCo-Chair, NIST Cloud Security Working Group

Best Practices to Secure Application Containers and Microservices

© c2labs.com

Federal Agency ChallengesModernizing IT

• Agility– Agencies are struggling to deliver more in a fiscally and

resource constrained environment

• Flexibility– Existing IT investments are typically problematic to

reconfigure or scale to meet new application demands

• Transparancy– Difficult to quantify the cost of optimizing legacy

infrastructure to support new applications

© c2labs.com

Context Aware ITData Centric Approach

• Understand your Data– Identify and understand the value of the data in your

organization

• Decompose Your Data– Break down applications and data into building blocks

• Monitor Your Data– Understand Risk to your Data

– Employ Continuous Monitoring of your Systems to identify and limit the damage an adversary has to your data

© c2labs.com

Emerging Technologies and TrendsMicroservices and Containers

• Microservices– Decompose Complex Applications into Small, Independent

Processes communicating with each other using language-agnostic API’s

– Highly Decoupled and Modular with services organized around capabilities (e.g. User Interface, Billing)

– Allows for Continuous Integration

• Containers– Much like Virtualization abstracts the Operating System from

Hardware, Containers abstracts to Applications from the Operating System

– Applications are isolated from other Applications on the same Operating System

– Allows for Cloud Portability and Scale Up/Out

– Security issues need to be evaluated and addressed in native container deployments

© c2labs.com

Container and Microservices DefinitionNIST SP800-180 (DRAFT)

Slide 4

http://csrc.nist.gov/publications/drafts/800-180/sp800-180_draft.pdf

© c2labs.com

Definition of MicroservicesNIST SP800-180

• Microservices: A microservice is a basic element that results from the architectural decomposition of an application’s components into loosely coupled patterns consisting of self-contained services that communicate with each other using a standard communications protocol and a set of well-defined APIs, independent of any vendor, product or technology.

• Microservices are built around capabilities as opposed to services, builds on SOA and is implemented using Agile techniques. Microservices are typically deployed inside Application Containers.

Slide 5

© c2labs.com

Definition of Application ContainersNIST SP800-180 (DRAFT)

• Application Containers: An Application Container is a construct designed to package and run an application or its’ components running on a shared Operating System.

• Application Containers are isolated from other Application Containers and share the resources of the underlying Operating System, allowing for efficient restart, scale-up or scale-out of applications across clouds. Application Containers typically contain Microservices.

© c2labs.com

Emerging Technologies and TrendsVirtual Machines vs Containers

• Define your Trust Boundary

• Security and Privacy– Behavioral Segmentation

– National Privacy Standard

• Management– Control Plane Standard

Source: NIST SP800-180 (DRAFT)

© c2labs.com

Microservices and Containers Use CasesGoogle

• “EVERYTHING at Google runs in a container”– Starts over 2 Billion Containers per week as of

2014

• http://www.theregister.co.uk/2014/05/23/google_containerization_two_billion/

© c2labs.com

Microservices and Containers Use CasesNetFlix

• Best Practices for Designing a Microservices Architecture– Create a Separate Data Store for Each

Microservice

– Keep Code at a Similar Level of Maturity

– Do a Separate Build for Each Microservice

– Deploy in Containers

– Treat Servers as Stateless

• https://www.nginx.com/blog/microservices-at-netflix-architectural-best-practices/

© c2labs.com

Container SecurityChallenges

• Increased Attack Surface– Containers are far more complex than VM’s wherein a single Application

can consist of 1000’s of microservices

– Underlying Linux Operating System complexities can be exploited by attackers to compromise all containers on a host OS

– Runtime Compromise / Vulnerabilities / Misconfiguration

• Secure Software Development– Containers can have code pushed to them from untrusted sources

• Log Management– Big Data Problem: How do you view and manage logs across 1000’s of

containers

• Orchestration– Infrastructure now runs as code (Puppet/Chef/Ansible)

– Software developers, not infrastructure staff now run the data center

© c2labs.com

Container SecurityChallenges

• File System Compromise– Microservices in the Application Container could be

compromised by an attacker

• Networking– A compromised container could result in lateral movement

• Run Time Compromise / Privilege Escalation– An attacker could modify a microservice in an Application

Container which compromises the application or container itself

© c2labs.com

Container SecuritySolutions

• Increased Attack Surface– Employ MicroVM’s (Just Enough VM)

– Monitor Containers at Runtime / Real-time scan for Vulnerabilities and Misconfiguration and Remediate

• Secure Software Development– Whitelist/Blacklist Containers

– Establish a secure container registry

– Sign containers and code (MD5)

• Log Management– Centralize container logs including developer actions

• Orchestration– Employ orchestration platform to manage containers across

environments (DEV,TEST,QA,PROD) and across clouds

© c2labs.com

Container SecuritySolutions

• File System Compromise– Ensure file system is read only

– Treat infrastructure as stateless

• Networking– Ensure application containers can only talk to other approved

application containers

• Run Time Compromise / Privilege Escalation– Set filter on Linux Kernel to prevent privilege escalation and

implement white lists

– Anomaly detection based on a deviation from a known baseline to prevent remote code execution

© c2labs.com

Microservices SecurityChallenges and Solutions

• Decomposition of Applications– Need to decompose applications into microservices

correctly so they only do one thing well, driving development of secure code

– Monolithic code with a 1,000 DLL's needs to be decomposed into 1,000 microservices which makes it more secure and maintainable

• Interface-driven development– Need to have well defined REST API’s to ensure

microservices talk consistently to each other

© c2labs.com

NIST and CSA PartnershipBest Practices for Application Containers and Microservices

• NIST and CSA have joined forces to define best practices for Application Containers and Microservices (ACM)– CSA ACM Members have joined the NIST ACM Cloud

Security Working Group

– NIST artifacts will serve as the foundation for CSA ACM work– NIST SP 800-180: NIST Definition of Microservices,

Application Containers and System Virtual Machines

– Additional artifacts from NIST ACM Working Group

© c2labs.com

NIST Application Container and Microservices (ACM) Charter

• NIST ACM Working Group Charter: http://collaborate.nist.gov/twiki-

cloud-

computing/bin/view/CloudComputing/ApplicationContainersAndMicro

services

• Objectives

– Aggregate and document application containers and microservices use

cases;

– Research and document the challenges of implementing and managing

application containers and microservices

– Identify process-based and end-product based threats to container

deployment and container stacks respectively;

– Provide security recommendations for adopting state of the art practices

for mitigating the identified threats.

© c2labs.com

NIST Application Container and Microservices (ACM) Charter

• NIST ACM Working Group Charter: http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/ApplicationContainersAndMicroservices

• Deliverables– Document the challenges of implementing and managing

application containers, with a particular focus on deployment and run-time security threats to application containers and microservices

– Document the security recommendations for mitigating identified deployment and run-time security threats to application containers and microservices

© c2labs.com

NIST Application Container and Microservices (ACM) Progress to Date

• NIST Progress to Date– Documented Challenges per a Use Case Template

– Created Methodology to Score Challenges

– Identified Best Practices to secure Application

Containers and Microservices

• NIST Path Forward– Complete internal review and publish documents for

public comment

© c2labs.com

NIST IR: ACM Challenges

© c2labs.com

NIST IR: ACM Challenges

© c2labs.com

NIST IR: ACM Challenges

© c2labs.com

NIST SP: ACM Best Practices

© c2labs.com

NIST SP: ACM Best Practices

© c2labs.com

NIST SP: ACM Best Practices

© c2labs.com

CSA Application Container and Microservices (ACM) Charter

• CSA ACM Working Group Charter:

• https://docs.google.com/document/d/1k_82U2BFgvA9j06MaI96VZAoMIYFm

Ag8HoAFA2GEA1Y/edit

• Objectives – Q3 2017

– Create an Application Container Implementation Guidance document that

includes:

– Overview of the Application Container threat landscape

– Unique security issues/concerns introduced by Application Containers

– Application Container host hardening and security recommendations

– Application Container hardening and security recommendations

– Security considerations for application containers in a DevOps environment

– Define Microservices secure development standards and governance

© c2labs.com

CSA Application Container and Microservices (ACM) Charter

• CSA ACM Working Group Charter:

• https://docs.google.com/document/d/1k_82U2BFgvA9j06MaI96VZAoMIYFm

Ag8HoAFA2GEA1Y/edit

• Objectives – Q4 2017

– Create a Microservices Implementation Guidance document that

includes:

– Best Practices for implementing a Microservices Architecture for

Cloud-native applications

– Best Practices for decomposing monolithic applications into

Microservices

© c2labs.com

NIST and CSA ACM Working GroupCall for Volunteers

• Email us and we’ll get you connected.– Anil Karmel, Co-Chair, NIST Cloud Security Working

Group, Co-Founder and CEO, C2 Labs– [email protected]

– Andrew Wild, CISO, QTS Data Centers– [email protected]

© c2labs.com

Anil [email protected]@anilkarmel

Thank you for your time