Network security is a major issue plaguing organizations and industries for so many years. COVID-19 created more opportunities for hackers to increase their attacks, due to people's fear of the virus, the need for virus-related information, and the work-from-home (WFH) setup.
Without a doubt, the COVID-19 pandemic made a massive impact on all aspects, including the workplace. Security professionals likewise face more IT security challenges because of the virus.
With the slight easing of health protocols, companies are now shifting to a hybrid work environment. Employees could alternate between working from home and working in the office.
The setup makes security officers work harder to secure the workplace and the personal devices of employees. The hybrid work setup is likely to stay, as many employees reported that they maintained or even increased their productivity in the new normal, adopting collaboration tools to accomplish their tasks.
In last year's Gartner survey of several CFOs, 74 percent said they intend to shift some of their employees to permanent work-from-home positions post-COVID.
Using containers for application portability
Employees were not able to bring their work computers home and had to use their personal devices, and access resources and applications related to the business to stay productive. Securing corporate networks and resources became more apparent.
One way to ensure the security of applications, and to limit the attack surface, is to use containers.
Technically, containers are in the realm of software development, but it affects everyone who engages in different applications inside and outside an enterprise.
Thus, it needs to be secure. Container security considerations and requirements are entirely different because its environment is more ephemeral and complex, and needs continuous provision of security.
Containerized applications offer reliability, higher levels of portability, and simplicity to the development and deployment of various software. With containers, the software can run reliably even if you move it to different computing environments.
You can split a single application into different modules, or microservices, and start an individual module only when needed.
On the side of an enterprise, several microservices in containers can reduce downtimes to enhance the business profitability and customer experience. For example, an internet presence is critical to most businesses to ensure success.
This means ensuring the usability of their apps and their websites. You can segregate specific features and functions of particular apps so the process is faster.
If you are launching a product, for example, and it’s difficult to foresee the traffic size, a container will give you the flexibility to Clone so the app can handle the increase in traffic.
Other than these, containers provide additional benefits, such as:
- Lower overhead
- Heighten portability
- Consistent operation
- Improved efficiency
- Improves development of applications
Importance of container security
While using containers can minimize the attack surface if it happens because of its size and configuration, it does not mean that containers are not vulnerable.
In April 2019 for example, the attackers exposed 190,000 Docker Hub repository accounts. While the breach reached just five percent of the customers of Docker Hub, the compromised accounts included access keys and tokens for auto-build functions in Bitbucket and Github.
As more companies are likely to use containers today and in the next few years, container security becomes more critical.
Container security means setting policies and using tools to make sure that containers remain safe from cyber threats and have a secure environment to operate.
As they are applications, they can corrupt tasks and processes when compromised.
Best practices to ensure container security
Be wary of the container's software. Developers often use open-source software when building containers. As dependencies are included in them, you need to know where they come from, how they were created, and the accompanying sources.
Ensure that you know what's inside the containers. You must check the processes at build time and inspect all the components to see what was included. Do not simply accept that the container's programs are all good.
Control root access. Root access is risky as it can modify or delete system files. Have a corporate policy that disallows containers to run as root.
Ascertain the container runtime. According to the NIST, container runtime is susceptible to cyberattacks as old runtime programs may have security holes. Ensure that you closely monitor its security patches.
Container image files should be from trustworthy sources. You should only download container images from sources you trust. Likewise, use only containers that are up-to-date and do not have insecure and old components.
Reduce container longevity and size. Containers are disposable. Use them when you need them, and dispose of/destroy them when they are no longer useful to you. When the container is not running anymore, an attacker cannot access it. Ensuring that you only use containers with short lives will help protect your enterprise.
Update container platforms regularly. As containers are also applications, it requires patches and updates. Make sure that you apply them as soon as they are available. If you are using Docker, its Docker Engine requires updates at least once a week.
Make the container life cycle visible. Make sure that you keep the entire container life cycle visible so that you can fix what's wrong. The visibility factor should include the container's definition until its production. You should likewise add pipeline Analytics and vulnerability scanning capabilities to it.
Frequently audit your environment. As the administrator, you can have access to container security tools by using either Kubernetes Auditing or Docker Bench for Security. These tools will allow you to audit application transactions, user activities, and other capabilities.
Use real-time monitoring. It is easier to respond to attacks if you employ real-time monitoring, which you can apply to monitor network activity. Of particular concern is the suspicious behaviors, especially those that can exploit your container environment's APIs.
Conclusion
Providing network security in the face of the post-pandemic workplace is no mean feat. Securing a network is relative. It should be based on the specific requirements of the organization.
The increasing use of containers means being vigilant because containers face various threats during the building process.
If you fail to check if the container you deploy is already compromised, unwary users can help open more doors for hackers to breach your critical data.
