An effective container security strategy consists of many parts. Organizations should first secure the build environment using secure code control along with build tools and controllers. Next, they should secure the contents of their containers using container validation, code analysis and security unit tests. Finally, they should develop a plan to protect their containers in production systems by focusing on runtime security, platform security and orchestration manager security.
But container security doesn’t end there. An effective security program consists of two other items, as well. These are monitoring and auditing.
All the container security processes mentioned above employ preventative security controls. These measures address known attack vectors with well-understood responses like vulnerability scans and encryption. But those and other security practices can only go so far, for they are designed to solve known issues. When it comes to detecting unexpected concerns, organizations can turn to monitoring to discover the unexpected stuff, track events in the environment and detect what’s broken.
Most monitoring tools begin by collecting events like requests for hardware resources and IP-based communication. They then examine them relative to the organization’s security policies. Towards this end, it’s best to use a monitoring solution that combines deterministic white and black list policies with dynamic behavior detection. This gives organizations the best of both worlds, allowing them to detect simple policy violations and unexpected variations.
For organizations to evaluate a monitoring tool, they should look to the following criteria:
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by David Bisson. Read the original post at: https://www.tripwire.com/state-of-security/devops/clarifying-the-misconceptions-monitoring-and-auditing-for-container-security/
The European Medicines Agency (EMA) says it was hacked by persons unknown.
Leading UK Credit Card Consumer Finance Company Uses Advanced Graph Analytics to Intercept Fraudulent Credit Card Applications, Boost Anti-Fraud Efforts…
Digital+ Partners Leads Continuation Funding Round in Growing Automated Threat Analysis & Detection Provider, Closing its Series B Round at…
For three years OpenWRT had a severe validation problem with its download package manager, until a fuzz tester found and…
It’s time to say a final “Goodbye” to Flash. (Or should that be “Good riddance”?) With earlier this week seeing…
1. Be a student of (information security, network security, cyber security). Always strive to know what the latest tactics, trends,…