Government organizations, like their private-sector counterparts, are adopting containerized environments at a rapid pace. Across industries, 50% of organizations using the cloud will deploy containers by 2022, says Forrester, and agencies from within the U.S. Department of Defense to the National Institutes of Health to the U.S. Department of Agriculture have embraced containers already.
There are good reasons for this shift in application development and operations. For development, containers offer advantages over “waterfall” approaches. Waterfall methodologies organize development projects in distinct linear phases. Containers support agile and DevOps processes, which emphasize automation and collaboration to build applications more iteratively and rapidly.
For operations, containers let you quickly spin up resources to scale compute power to meet new demand. And if you encounter an issue with an application component you don’t need to shut down the entire application to resolve it because they’re built on microservices. Instead, you can fix the component while the rest of the application remains functional.
But while containers simplify some aspects of IT, they can complicate others. In particular, containers introduce new cybersecurity challenges. Understanding the unique cyber-risks of containers, along with the tools and strategies for mitigating them, can help you take advantage of the benefits of containers while also keeping them secure.
Containers Are Just One Piece of the Cyber Puzzle
Containers present old and new cyber issues. For starters, container images can contain vulnerabilities. More problematic, cybercriminals can design a malicious image to look like a legitimate image. They can then upload the image to a public registry such as Docker Hub to trick admins into deploying the malicious version.
Microservices also introduce cyber-risk, because the more microservices you use, the more components communicate with one another. Your agency might run microservices across both on-premises and multi-cloud environments—placing compute in Microsoft® Azure, say, and storage in AWS need to be tied together in a secure fashion. And if you fix a problem component and redeploy it, the redeployment needs to be based on a secure, up-to-date snapshot.
With containers, infrastructure monitoring becomes more challenging. Containers call for specialized monitoring tools providing insights into more than the containers. You also need to monitor the rest of your system and network components in the context of those containers. For example, if an application stops working, you need a way to identify the source of the problem quickly and easily, whether it’s an application component, the container, or the server or network.
You can address some of these issues with tried-and-true approaches such as vulnerability scans. A security information management system (SIMS) can also collect relevant data such as log files in a central repository for analysis.
You’ll need additional security for your containers if your agency is implementing a zero-trust framework and technology providers are beginning to respond. Container platforms like Dockers and Kubernetes offer greater visibility, further enhancing security. And third-party providers proactively look for vulnerabilities in containers as they’re being deployed using security analysis tools.
Technologies around service mesh, which control how application components share data with one another, are also gaining maturity. Software-defined wide area networks (SD-WANs) enable encrypted communications across environments. They let you specify, for example, where certain containers can talk only to other certain containers or when communication can be one-way but not two-way.
An infrastructure monitoring and management platform can help you administer and secure your containers. Providing a single pane of glass to manage in both on-prem and multi-cloud environments can simplify the security complexity inherent to containers. An effective platform should enable you to:
- Track details such as hosts, host clusters, environment dependencies, and deployments
- Review metrics for containers, hosts, and other infrastructure elements
- Analyze container activity in an application-stack management tool
- Organize containers in a mapping tool for managing the physical and logical relationships among infrastructure entities
- Display detailed data about individual containers on a single screen
Technology is Just One Piece of the Cyber Solution
But technology is only part of the solution—people are the rest.
IT functions are often structured with teams for DevOps, which handles application development and operations, and SecOps, which handles cybersecurity and operations. Part of the goal behind DevSecOps (development, security, and operations) is to bring together the brainpower of both teams. Over time, your agency should develop a technical talent pool with diverse expertise and experience to help cover all your cybersecurity bases.
In March 2021, FedRAMP released vulnerability-scanning requirements for containers. A key intention of the requirements is to promote knowledge of best practices for the safe use of clouds. Training in best security practices around containers is as essential for your developers and software engineers as it is for your security pros.
Also, look to your IT providers for their input and expertise. They should be happy to share their knowledge and experience to ensure you get the most from their cloud- and container-focused technologies and you also know how to implement them securely.
Your organization should meet the FedRAMP requirements for container security, but keep in mind the guidance doesn’t cover every detail necessary to ensure strong security for your containerized environments. After all, cyber vulnerabilities, cyber threats, and your unique cyber risks will constantly evolve. You need continuous monitoring, ongoing analysis, and continuing education for your IT team. And it’s just as important to document processes for extending a cyber-safe culture throughout your organization as you deploy more containers.
Visit our website for information on the SolarWinds® Server & Application Monitor solution and how it can help you monitor your containerized applications.
