SLIDE 1
1
Docker security 12.03.2019
Docker world Containers VS Virtual machine Security concerns Conclusion
1 Agenda Docker world Containers VS Virtual machine Security - - PowerPoint PPT Presentation
1 Agenda Docker world Containers VS Virtual machine Security - - PowerPoint PPT Presentation
12.03.2019 Docker security 1 Agenda Docker world Containers VS Virtual machine Security concerns Conclusion Whoami M.Sc Computer Security M.Sc Software Development Worked previously as an embedded software developer Actually
SLIDE 2
SLIDE 3
Whoami
➔ M.Sc Computer Security ➔ M.Sc Software Development ➔ Worked previously as an embedded software developer ➔ Actually working at ImmunIT ➔ Pentesting ➔ Secure coding training ➔ Security awareness training ➔ Social Engineering ➔ Project Management ➔ R&D developer
SLIDE 4
4
Docker security
SLIDE 5
What is docker?
Containerization Operating-system-level virtualization Execution environment virtualization
SLIDE 6
What is docker?
SLIDE 7
What is docker?
SLIDE 8
What is docker?
SLIDE 9
Why using docker?
➔ Isolate services ➔ Simplify micro-services enhancement and maintenance ➔ Avoid dependency issues ➔ Allow to execute untrusted code safely ➔ Reduce risks involved by a compromise ➔ etc
SLIDE 10
How it works?
SLIDE 11
Docker basics
SLIDE 12
Dockerfile & docker-compose
Dockerfile
➔ Defines a docker image
SLIDE 13
Dockerfile & docker-compose
Docker-compose
➔ Defines a containers stack ➔ Overwrite Dockerfile behaviors
SLIDE 14
Orchestration
➔ Automates image buildings ➔ Automates deployment ➔ Resilient ➔ Macro management ➔ Live metrics
SLIDE 15
Orchestration
Orchestrators
SLIDE 16
Orchestration
Registry & rancher
SLIDE 17
Orchestration
Rancher overview
SLIDE 18
Orchestration
Rancher overview
SLIDE 19
Orchestration
Rancher overview
SLIDE 20
20
Docker security
Containers VS Virtual Machine The millennial war
SLIDE 21
Containers VS Virtual Machine
Virtual Machine! Containers!
SLIDE 22
Containers VS Virtual Machine
SLIDE 23
Containers VS Virtual Machine
SLIDE 24
24
Docker security
Security concerns
SLIDE 25
Kernel namespace
➔ Containers process are running in their own kernel namespace ➔ Provides segregation ➔ Decreases risk exposure ➔ Containers get their own network stack
SLIDE 26
User namespace
➔ Best way to prevent privilege escalation attack ➔ Configured on the host level ➔ Prevent root usage
SLIDE 27
Tools
Docker notary
➔ Verify image signature ➔ Ensure integrity ➔ Avoid backdoors ➔ Cross platform
SLIDE 28
Tools
Docker notary
SLIDE 29
Tools
Docker bench security
SLIDE 30
Tools
Traefik
SLIDE 31
Tools
CoreOS
SLIDE 32
Tools
Dockscan
SLIDE 33
Container hardening & Access Control Management
SLIDE 34
Container hardening & Access Control Management
Seccomp
SLIDE 35
Container hardening & Access Control Management
SE Linux
SLIDE 36
Container hardening & Access Control Management
App Armor
SLIDE 37
Flags
Volume vs mount vs tmpfs
SLIDE 38
Flags
Winner is volume
➔ Easier to back up ➔ Can be managed through the docker CLI ➔ Cross-platform ➔ Safe sharing ➔ Remote volume ➔ Data encryption (LVM, LUKS)
SLIDE 39
Flags
Winner is volume
➔ Avoid mounting sensitive folder ➔ Use ro flag when needed
SLIDE 40
Flags
Privileged container
- -privileged is evil
➔ Privileged container run as a proper OS ➔ Can modify interfaces / iptables ➔ Access host devices
SLIDE 41
Flags
Security opt
SLIDE 42
Flags
Network namespace
SLIDE 43
Flags
Network namespace
➔ Use dedicated networks ➔ Isolate containers on separated networks ➔ Create networks for exposed containers ➔ Segregate and segment networks as your own internal network
SLIDE 44
Ports exposure
➔ Control services exposure ➔ Do not expose unnecessary ports
SLIDE 45
Ports exposure
EXPOSE keyword is overwritten by –p flag at runtime
Docker run –rm –it –p 0.0.0.0:1337:80 alpine Docker run –rm –it –p 127.0.0.1:1337:80 alpine
SLIDE 46
How to avoid Denial of Service attack
SLIDE 47
How to avoid Denial of Service attacks
By default, a container has no resource constraints and can use as much of a given resource as the hosts’s kernel scheduler will allow
SLIDE 48
How to avoid Denial of Service attacks
Memory usage
SLIDE 49
How to avoid Denial of Service attacks
CPU usage
SLIDE 50
50
Docker security
Conclusion
SLIDE 51
Best practices
➔ Harden your containers ➔ Isolate your containers ➔ Keep up to date the underlying operating system ➔ Use security tool to monitor your containers
SLIDE 52
Conclusion
Consider your containers as any physical machine and ensure their compliance towards your company security policies
SLIDE 53
53
Docker security
SLIDE 54
54
Docker security
QUESTIONS ?