Don’t be a fail whale, secure your containers
summary
Covers container-specific threat modeling and concrete controls: follow the NIST container hardening note (~10 pages) and the CIS benchmark via Docker Bench Security or OpenSCAP, enforce SELinux and read‑only filesystems, deploy runtime IDS like Falco, and use vulnerability scanners (Clair, Tenable/Tenable Container, Aqua/Twistlock). Strong recommendation that image signing first (Notary/registry signing) prevents most attacks, Binary Authorization is now beta for Kubernetes CI/CD integration, and teams must monitor alerts and integrate checks into pipelines.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:04Public service announcement - British Airways
- 2:58What we're going to talk about today
- 3:56Recap of threat modelling
- 4:58Definitions of threat modelling
- 6:26The security circle of life
- 7:17Why should you use threat modelling with containers?
- 9:26Threat modelling for containers
- 9:52Container implementation models
- 10:55Audit - Docker Bench Security
- 12:25Audit - OpenSCAP
- 13:33Runtime security-SELinux
- 15:22Container image security - Notary
- 17:43Orchestrator/control channel security - Kubernetes
- 19:27Vulnerability scanning - Tenable Flawcheck/Container Security
- 20:22Where do these tools fit in container architecture?
- 22:49Useful documents and links
related talks
05mContainer Security Best Practices
40mSecuring Containers on the High Seas
27mContainer Security Best Practices
50mRuntime Security for Containers
35mThe 10 steps of Container Security: It's not that hard !
28mContainer Security: A Horror Story
30mMaster the Container Security Model with
18mPractical End-to-End Container Security at Scale