Containers and Kubernetes are essential tools for multi-cloud app development, but they are often overlooked when it comes to security. According to the recent Kubernetes report by the Cloud Native Computing Foundation, 28% of organizations have workloads running in insecure Kubernetes configurations. This leaves the door open for system compromises and exposes sensitive data. Despite these concerns, Kubernetes remains the most widely used container orchestration platform, commanding 92% of the market. Its popularity can be attributed to its portability, open-source nature, ease of use, and scalability.
The Growing Importance of Containers
Gartner predicts that by 2029, over 95% of enterprises will be running containerized applications in production, a significant increase from less than 50% last year. Additionally, it is estimated that in five years, 35% of all enterprise applications will run in containers. This growth is driven by the advantages containers offer in terms of agility, scalability, and efficiency. Furthermore, the majority of commercial off-the-shelf (COTS) vendors will be offering their software in container format, further solidifying the dominance of containers in the DevOps landscape.
The Vulnerabilities of Containers
Despite their widespread adoption, containers remain a weak link in software supply chains. Misconfigured cloud, container, and network configurations, along with confusion over ownership of container security, pose significant challenges for organizations. Attackers are taking advantage of these vulnerabilities by exploiting weaknesses in container images, runtimes, API interfaces, and container registries. Unsecured containers with lax identity security provide a lucrative target for insider attackers.
When container images are compromised, attackers can easily infiltrate entire networks and infrastructures. Unfortunately, most attacks go undetected for an average of 277 days. Container security often fails due to weak or inconsistent configurations, making it essential for organizations to address these challenges.
“There is no single solution on the market that solves all these challenges; it takes change management in DevOps, DevSecOps, and software engineering to help improve container security.”
To enhance container security, organizations can start by following NIST’s Application Container Security Guide (NIST SP 800-190). This guide provides a thorough assessment of potential container risks and offers practical recommendations for mitigating them. NIST emphasizes that the responsibility for container security lies primarily with developers. Hence, organizations should ensure that their developers have the necessary knowledge, skills, and tools to make informed decisions. Furthermore, it is crucial to empower security teams to define and execute quality throughout the entire development cycle.
