The Matrix of IT Infrastructure: Containers

Containers are not simple applications that run on the fly. Containers are the matrix of the IT infrastructure. Most IT professionals still struggle to understand containers, and some security practitioners find it difficult to provide appropriate security controls for them. As a result, containers are becoming environments that are difficult to properly defend.

Containers, by their very nature, may be the most vulnerable thing in IT when it comes to security. There are numerous security arsenals, controls and requirements that need to be put in place to maintain a secure container infrastructure environment. From the security architecture perspective, it would be very useful to focus on the most critical and tricky questions to understand and assess the security of the containerised environment and applications. Below are 19 questions that need to be asked. And, it is assumed that you already know the correct answers to these questions when you perform your security assessment.

The Most Critical Questions For Containers

1. How is network zoning of clusters, namespaces and deployments, and their traffic defined and managed across the container infrastructure?
2. How is secrets management handled?
3. How is PKI handled throughout the environment?
4. How are all logs including instantaneous state of containers collected and managed?
5. How is the role description of the entire cluster user management defined?
6. How and at what levels is image security provided?
7. How are container and user privileges controlled?
8. How are interactive users and administrators are managed and authenticated?
9. How are registries and repositories handled?
10. How are containers and workloads with different sensitivity levels are maintained in cluster or in container environment instances?
11. How is the network traffic secured?
12. How are application-level attacks handled?
13. How is vulnerability management handled for the entire environement and its underlying components?
14. How is runtime security maintained?
15. Is the containerised application in its own cluster or does it share a cluster?
16. How are the containerised application components layered?
17. Is the containerised application open to (inbound) internet traffic?
18. Is the containerised application a part of a traditional application?
19. How is the containerised application segmented or isolated from other applications in the cluster?

* For the container security controls and hardening tips, you can also check this post.