Top Banner
1 Docker security 12.03.2019
54

PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

May 20, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

1Docker security

12.03.2019

Page 2: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Docker world

Containers VS Virtual machine

Security concerns

Conclusion

Agenda

Page 3: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Whoami

➔M.Sc Computer Security

➔M.Sc Software Development

➔Worked previously as an embedded software developer

➔ Actually working at ImmunIT

➔ Pentesting➔ Secure coding training➔ Security awareness training➔ Social Engineering➔ Project Management➔ R&D developer

Page 4: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

4Docker security

Page 5: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

ContainerizationOperating-system-level virtualizationExecution environment virtualization

Page 6: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 7: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 8: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 9: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Why using docker?

➔ Isolate services

➔ Simplify micro-services enhancement and maintenance

➔ Avoid dependency issues

➔ Allow to execute untrusted code safely

➔ Reduce risks involved by a compromise

➔ etc

Page 10: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How it works?

Page 11: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Docker basics

Page 12: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Dockerfile & docker-composeDockerfile

➔ Defines a docker image

Page 13: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Dockerfile & docker-composeDocker-compose

➔ Defines a containers stack

➔ Overwrite Dockerfile behaviors

Page 14: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Orchestration

➔ Automates image buildings

➔ Automates deployment

➔ Resilient

➔Macro management

➔ Live metrics

Page 15: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationOrchestrators

Page 16: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRegistry & rancher

Page 17: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 18: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 19: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 20: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

20Docker security

Containers VS Virtual Machine The millennial war

Page 21: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Virtual Machine! Containers!

Page 22: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Page 23: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Page 24: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

24Docker security

Security concerns

Page 25: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Kernel namespace

➔ Containers process are running in their own kernel namespace

➔ Provides segregation➔ Decreases risk exposure

➔ Containers get their own network stack

Page 26: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

User namespace

➔ Best way to prevent privilege escalation attack

➔ Configured on the host level

➔ Prevent root usage

Page 27: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker notary

➔ Verify image signature

➔ Ensure integrity

➔ Avoid backdoors

➔ Cross platform

Page 28: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker notary

Page 29: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker bench security

Page 30: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsTraefik

Page 31: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsCoreOS

Page 32: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDockscan

Page 33: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control Management

Page 34: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementSeccomp

Page 35: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementSE Linux

Page 36: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementApp Armor

Page 37: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsVolume vs mount vs tmpfs

Page 38: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsWinner is volume

➔ Easier to back up

➔ Can be managed through the docker CLI

➔ Cross-platform

➔ Safe sharing

➔ Remote volume

➔ Data encryption (LVM, LUKS)

Page 39: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsWinner is volume

➔ Avoid mounting sensitive folder

➔ Use ro flag when needed

Page 40: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsPrivileged container

--privileged is evil

➔ Privileged container run as a proper OS

➔ Can modify interfaces / iptables

➔ Access host devices

Page 41: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsSecurity opt

Page 42: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsNetwork namespace

Page 43: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsNetwork namespace

➔ Use dedicated networks

➔ Isolate containers on separated networks

➔ Create networks for exposed containers

➔ Segregate and segment networks as your own internal network

Page 44: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Ports exposure

➔ Control services exposure

➔ Do not expose unnecessary ports

Page 45: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Ports exposure

EXPOSE keyword is overwritten by –p flag at runtime

Docker run –rm –it –p 0.0.0.0:1337:80 alpineDocker run –rm –it –p 127.0.0.1:1337:80 alpine

Page 46: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attack

Page 47: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacks

By default, a container has no resource constraints and can use as much of a given resource as the hosts’s kernel scheduler will allow

Page 48: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacksMemory usage

Page 49: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacksCPU usage

Page 50: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

50Docker security

Conclusion

Page 51: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Best practices

➔ Harden your containers

➔ Isolate your containers

➔ Keep up to date the underlying operating system

➔ Use security tool to monitor your containers

Page 52: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Conclusion

Consider your containers as any physical machine and ensure their compliance towardsyour company security policies

Page 53: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

53Docker security

Page 54: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

54Docker security

QUESTIONS ?


Related Documents
AdministrationGuide - PacketFence · or"127.0.0.1")thatPacketFencewillbeinstalledon.

AdministrationGuide - PacketFence ·...

Category: Documents
House Enrolled Act 1337

House Enrolled Act 1337

Category: Documents
mpadv01-20200625134943 · 2020. 7. 1. · DIN EN 1337-5 2005-07 DIN EN 1337-6 2004-08 DIN EN 1337-7 2004-08 DIN EN 1337-8 2008-01 DIN EN 1337-9 1998-04 Ausstellungsdatum: 03.06.2020

mpadv01-20200625134943 · 2020. 7. 1. · DIN EN 1337-5...

Category: Documents
2394-NOMOS 1337 TRITSH

2394-NOMOS 1337 TRITSH

Category: Documents
Amparo 1337 / 2010

Amparo 1337 / 2010

Category: Documents
Job Description 1337

Job Description 1337

Category: Documents
Folha Extra 1337

Folha Extra 1337

Category: Documents
Νόμος Τρίτση (1337/1983)

Νόμος Τρίτση (1337/1983)

Category: Documents
Πολιτεία 1337

Πολιτεία 1337

Category: Documents
1337 یهاشنهاش یسرزاب نامزاس سیسأت دنور یسرربhii.alzahra.ac.ir/article_2064_58e8e68f3ced65b07258ba3c86a14e0c.pdf · 1337 یهاشنهاش یسرزاب

1337 یهاشنهاش یسرزاب نامزاس سیسأت.....

Category: Documents
STOLETÁ VÁLKA 1337 - 1453

STOLETÁ VÁLKA 1337 - 1453

Category: Documents
Listas pilas colas_carlos_rosario10-1337

Listas pilas colas_carlos_rosario10-1337

Category: Documents