Container Security - Strengthening the Heart of your Operations
Tags: devseccon, security, opensource, softwareengineering
Published: 2023-07-05 21:47:26

Another great talk at the [DevSecCon](https://www.devseccon.com/) conference was "Container Security - Strengthening the Heart of your Operations", by [Siddhant Khisty](https://www.linkedin.com/in/siddhant-khisty-16974019b/) and [Kunal Verma](https://www.linkedin.com/in/verma-kunal/). 

Kunal is a Community Manager at [Kubesimplify](https://kubesimplify.com/).

Siddhant is a Community Manager at [WeMakeDevs](https://wemakedevs.org/).

[The video from the DevSecCon conference](https://www.youtube.com/live/vNX_ILWOolk?feature=share&t=3565)

![Container Security - Strengthening the Heart of your Operations](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wn42fmkntp4zw0jpedoc.png)

Short sum up of this amazing talk, to give you some understanding till you can watch the whole video 😊

I really liked their definition of the container as a way to package an application with all the dependencies.

While dealing with container security, understanding of architecture is essential:
- Hypervisor
- (Operating System)
- Kernel
- Hardware
![While dealing with container security, understanding of architecture is essential](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/610rfvsbovkbmn0svcug.png)

What does the container workflow look like?
![What does the container workflow look like?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5jl09j9hi13n2sd0za2x.png)

What are the reasons for securing container images?
![What are the reasons for securing container images?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7x05jtpjsppmdvrc2orv.png)

Secure Container Image improves protection against:
- Unauth Access
- Data Breaches
- Vulnerability Exploit
- Malicious Code
- Malware
- Compliance Validation
![Secure Container Image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iyfjjzr8kn49ewkglg35.png)

5 questions regarding your container image security.

Q1. Are the container images up-to-date?
- use stable releases
- check for available security patches or updates
![Are the container images up-to-date](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0qedc6ds2b0c7f9nznf2.png)

Q2. Are container images scanned regularly?
- Scanning for vulnerabilities using tools like Kubescape
- Process to address the discovered security issues
![Are container images scanned regularly](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dm1ivj7krfkh8b4gjr68.png)

Q3. Are container images verified?
- From reputable & trusted sources
- Verify integrity and authenticity
![Are container images verified](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l8muary26s9esnw8rzcv.png)

Q4. Are container images signed?
- Implement image signing using tools like cosign
- Process to verify digital signatures & ensure integrity
![Are container images signed](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h712u3k958osa6txsxtr.png)

Q5. Is a Zero-trust model being implemented?
- Follow a zero-trust approach
- Implement strict access controls & auth mechanisms

![Is a Zero-trust model being implemented](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/95jdzym8t9d6cwm55xla.png)

Another key point of the talk was discussing the image registry.

Securing Image Registry is even more important than making sure your container images are secure:
- Safeguard from unathorised access or misuse
- Reduce risk of deploying compromised images
- Ensure compliance & trustworthiness
![Securing Image Registry is even more important than making sure your container images are secure](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yadha5bzpmf1yd4uqv5l.png)

There are 4 main questions to make sure your container registry is secure.

Q1. Is the image registry public or private?
- Use private image registry
- If public, assess the potential risks + implement security measures
![Is the image registry public or private?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p1uc9pucrdk1cqvw8kc8.png)

Q2. Is the image registry server secure?
- Restricted network access to the server
- Regular patching, hardening and monitoring
![Is the image registry server secure?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a7zz5mj6o6xchmnmmhz9.png)

Q3. Are access controls properly configured?
- Granular access control for push, pull & modify images
- Authentication mechanism to allow only authenticated users
![Are access controls properly configured?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q1p9hrr4dlkvn4cmjwd2.png)

Q4. Are vulnerabilities being monitored?
- Regularly monitor stored container images
- Integrate vulnerability scanning tools such as trivy
![Are vulnerabilities being monitored?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4xk1nqdznpvffco5z8o7.png)

Attackers have a huge playground. How can we reduce it?
- Reduce your attack surface
- Lightweight base images
- Multi-stage builds
![Attackers have a huge playground. How can we reduce it?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/54xc1pibvq97kiay850q.png)

How to choose security tools? Which parameters to consider?
- Vulnerability Scanning
- Image integrity & verification
- Runtime protection
- Complience and Audit Capabilities
![How to choose security tools? Which parameters to consider?](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ek07o9r95rmz8u0o3d3i.png)

Some of the tools, which are spread around #opensource ecosystem:
- Clair - Static Vulnerability Analysis
- Sysdig - Container Runtime Security
- Snyk - Container Vulnerability scan & monitoring
- Kubescape - Vulnerability Scanning for Images & Image Registry
- Falco - Run-time Security
- Trivy - Vulnerability Scanning
![Some of the tools, which are spread around #opensource ecosystem](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bpsuorol79zbot2y4i49.png)

Takeaways:
- Image security
- Registry security
- Secure the build process
- Host Security
- Tools to make life easier
![Takeaways](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a95dwsabsdve7lucj2i3.png)

Overall it was a great talk and I am really grateful to Kunal and Siddhant for sharing their expertise.

Special thanks to @snyk_sec for powering the DevSecCon conference.