Securing Containers on the High Seas
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 14:15· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Argues for an enterprise container security strategy that hardens every lifecycle phase and gives concrete controls: use Claire and Dependency-Check in CI to catch vulnerable packages, sign images with Docker Content Trust and enforce via admission controllers, run Brigade webhooks to trigger scans, use Vault and Kubernetes init containers for dynamic secrets, prefer minimal base images like Alpine, enable seccomp/AppArmor/SELinux, apply PodSecurityPolicies and RBAC, and deploy a service mesh (Envoy) for mTLS and segmentation to limit lateral movement.
AI-written summary · about
chapters (21)
- 0:00Start
- 2:24What Are Containers
- 2:45Container Architecture
- 4:23Containers Do Not Equal Security
- 8:47Runtime
- 10:42Access Control
- 11:32The Build Phase
- 11:50Base Image Management
- 12:46Leverage the Built in Linux Kernel Security Modules
- 13:22Limiting Privileges
- 14:26Kernel Hardening
- 16:00Mandatory Access Control
- 17:38Container Package Management
- 18:31Dependency Check
- 21:00Admission Controls
- 22:14Pod Security Policies
- 23:50Example of the Kubernetes Control Plane
- 27:04Authentication
- 27:48Roles
- 30:01Secrets Management
- 32:38Conclusion
related talks
05mContainer Security Best Practices
48mContainer Security: It’s All About the Supply Chain
24mDon’t be a fail whale, secure your containers
46mWhat Security People Want: Making DevSecOps Happen with Containers
18mPractical End-to-End Container Security at Scale
27mContainer Security Best Practices
28mContainer Security: A Horror Story
36mPanel Discussion: Modern App Security Requires Containers