Containers and Orchestrators are being rapidly adopted worldwide due to the advantages they provide. But so has risen the cyber attacks on the same. With the rise in recent vulnerabilities there’s an ever more demanding need to enforce security in containers.
Even with Static Analyzers in place which scan for known vulnerabilities, a new vulnerability can pop up anytime or you can be compromised at runtime. We should try to reduce the attach surface to secure against these unknown unknowns.
This talk will be about how can one choose to be a minimalist about their workloads right from choosing the right node images to reducing dependencies in containers and finally restricting and minimizing risks at runtime. We will explore about Container Optimized OS' , RBAC, Docker Slim, Network Policies, Kubernetes Security Context and tooling around Mandatory Access Control and how they can help you out on your path to become minimalist with your workloads to secure them.
---
Ecosystem generally promotes the use of Static Analysers. But static analysers in place scan for known vulnerabilities and a new vulnerability can pop up anytime or you can be compromised at runtime which may end up in losses. We should try to reduce the attack surface as much as possible to reduce these unknown unknowns.
Understanding the entities of your application and infrastructure and being minimalist about them goes a long way in securing the supply chain.
A great example is the Shellshock vulnerability in bash. Bash being a seemingly innocent package, no one would care about securing it in general. But Bash had a vulnerability for more than 2 decades and only got discovered in 2014 which is still being exploited by many attackers. But imagine containers built from scratch or on top of alpine/busybox. They dont' have bash at all and would be secure from the vulnerability.
This talk takes many such usecases and real life examples to explain how just having a reduced attack surface could go so long in securing your application and infrastructure.
