TL;DR NIST Container Security Standards
summary
Summary of a 63-page NIST report that lists concrete controls: scan and sign images, delete old images and use immutable, versioned names (myapp:2.3), push/pull registries over TLS and require auth, run container-specific OSs, use container-aware vulnerability scanners and malware monitoring, restrict orchestrator admin with RBAC and MFA, separate overlay networks by sensitivity, prefer rootless and read-only containers, monitor runtimes for escapes, and automate enforcement across dev/test/prod so compromised nodes can be isolated without cluster-wide failure.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:28Quick Intro
- 2:10The Report
- 3:12Report Basics
- 14:56Image Vulnerabilities Countermeasures
- 16:30Registry Vulnerabilities Countermeasures
- 17:49Orchestrator Vulnerabilities Countermeasures
- 19:12Container Vulnerabilities Countermeasures
related talks
05mContainer Security Best Practices
24mDon’t be a fail whale, secure your containers
27mContainer Security Best Practices
35mThe 10 steps of Container Security: It's not that hard !
48mContainer Security: It’s All About the Supply Chain
26mThe 10 Container Security Tricks That (...)
28mContainer Security: A Horror Story
40mSecuring Containers on the High Seas