The Security Challenges of Enterprise Container Adoption
The container adoption wave has swept across the US over the last five years and has been gaining traction in Europe, the Middle East and Asia.
The blending of development and operations processes into DevOps has also changed the way software is deployed from a traditional waterfall development model to one that is agile, dynamic and elastic. As a result, the attack surface is constantly evolving and traditional virtual machines (VMs) no longer offer the level of flexibility and reliability needed to keep pace with today’s changing software environment.
Known as the next generation of virtualization, containers solve the ongoing challenge of trying to get software to run reliably when moved from one computing environment to another.
These modern applications are the total software package: lightweight and portable, with everything needed at runtime: code, system tools and libraries. And while containers are similar to VMs, they are much smaller and more efficient, able to run on almost any computer, infrastructure or cloud. Unlike VMs though, containers use shared operating systems and thus do not overwhelm the system resources. Furthermore, hundreds or potentially thousands of containers can run on just one server, saving valuable data center budget.
At the moment, containerization is increasingly being used for web services, such as Google Apps, but its applicability is forecasted to grow rapidly across various sectors, including the government.
Containers are cool, but are they secure?
Of the key strengths of containers is their ability to be spun up and down almost instantly, however, this has also become a serious security challenge. One of the big issues is the lack of visibility into the container itself, largely because of its short lifespan, which can run from a few hours to a few days, and the application’s ability to be instantly deleted or replaced.
Containers are also less isolated from one another. This means that it’s more difficult to ‘talk’ to individual containers, unlike talking to a virtual host.
