Learning Path
Scan container images for vulnerabilities
New threat vectors
As described in NIST SP 800-190, Application Container Security Guide, a containerized environment introduces the following new threat vectors that must be secured:
Image
- Image vulnerabilities
- Configuration defects
- Embedded malware
- Embedded clear text secrets
- Untrusted images
Registry
- Insecure connections to registries
- Stale images in registries
- Insufficient authentication
- Insufficient authorization restrictions
Orchestration
- Unrestricted admin access
- Unauthorized orchestrator access
- Poorly isolated inter-container network traffic
- Mixing of workload sensitivity levels
Container
- Runtime software vulnerabilities
- Unbounded network access
- Insecure runtime configurations
- Application vulnerabilities
- Rogue containers
Host OS
- Large attack surface
- Host OS component vulnerabilities
- Improper user access rights
- Host OS file system tampering
- Poor host OS configuration
Security across the lifecycle
These threat vectors are typically encountered in the three phases of the container lifecycle -- build, ship, and run:
Although this learning path focuses only on the container image, it is important to plan and code security to target all of these threat vectors. You should also be sure to include security across all the phases of the lifecycle, implementing a DevSecOps approach.
