As more organizations look to deploy containers in public cloud providers, the number of solutions and types of container security tools designed to help continue to increase. This piece lists the top commercial and open source container and orchestration tools
to consider within a cloud environment, and offers recommendations for ensuring your architecture is secure, compliant and well-positioned for the future.
Container Security Tools for Cloud Environments
Containers allow a developer to package up an application with all the parts it needs, such as libraries and other dependencies, and ship it all out as one package. The container market is exploding, especially within cloud services like Amazon Web Services
(AWS), Google Cloud Platform (GCP) and Microsoft Azure. The options are plentiful, and the decision is usually made by developers.
Some top container tools available in cloud service provider (CSP) environments include (in alphabetical order):
- Amazon ECS gives users a scalable architecture that is deeply integrated into other AWS services, like CloudTrail, AWS IAM and CloudFormation.
- Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service you can use to run Kubernetes on AWS without needing to install, operate and maintain your own Kubernetes control plane or nodes.
- AWS Fargate is a compute engine for AWS that allows you to run containers without having to manage a cluster of Amazons EC2 instances, so you no longer have to pick the instance types, manage cluster scheduling or optimize cluster utilization.
- Azure Kubernetes Service (AKS) offers managed Kubernetes orchestration, along with enterprise-grade security and governance. It’s not as mature as AWS EKS or Google Kubernetes Engine (GKE), but it will get better over time.
- Docker is by far the most widely adopted container technology in the industry. It’s designed to make it easier to create, deploy and run applications using containers.
- Docker Swarm is a clustering and scheduling tool for Docker containers. It lets IT administrators and developers establish and manage a cluster of Docker nodes as a single virtual system.
- GKE is a secured and fully managed Kubernetes service with a revolutionary autopilot mode of operation. Google created Kubernetes and this is a good option for a managed service.
- Kubernetes is a portable, extensible open-source platform for managing containerized workloads and services that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem, and Kubernetes services, support and
tools are widely available.
- Mesosphere DC/OS (short for Data Center Operating System) is an open-source, distributed operating system built with Apache Mesos. The difference between DC/OS and other cluster managers is its ability to provide dedicated container scheduling.
- Red Hat OpenShift is an open source lightweight operating system based on the Linux kernel and designed for providing infrastructure to clustered deployments, while focusing on automation, ease of application deployment, security, reliability and scalability.
Container Security Monitoring Tools
Some container security monitoring tools to consider include (in alphabetical order):
- Aqua provides full development-to-production security across your entire continuous integration and continuous deployment (CI/CD) pipeline and runtime environment, giving you end-to-end visibility and protecting your applications against attacks.
- Clair is an open source project for the static analysis of vulnerabilities in applications and Docker containers. It checks for vulnerabilities using a continuously imported list from a known set of sources and correlates it with the indexed contents
of container images to produce lists of vulnerabilities that threaten a container. When vulnerability data changes upstream, the previous state and new state of the vulnerability, along with the images they affect, can be sent via Webhooks to a configured
endpoint. All major components can be customized programmatically at compile time without forking the project.
- Palo Alto Prisma, formerly Twistlock, is part of a larger suite and offers container security that is very comprehensive and scans all the images in the registry and the images during the build and deploy process, as well as continuously monitors any
vulnerability changes in running containers.
- Snyk is designed to help developers find and fix vulnerabilities in cloud-native applications. It’s really good at finding vulnerabilities in open source libraries and strong at matching vulnerabilities to Docker file commands.
- StackRox, now part of Red Hat, protects applications across the entire container lifecycle. The software discovers your full container environment, ensures assets adhere to your security policies, and identifies and stops malicious actors. It enables
continuously improving security.
- Sysdig created Falco, the open standard for runtime threat detection for containers, hosts, Kubernetes and cloud. The platform is built on an open source stack and is pure SaaS. Widely adopted by site reliability engineers (SRE) for its ease of use and
open source hooks, Sysdig covers six steps to container security:
- Cloud security
- Image scanning
- Network segmentation
- Threat detection and response
- Monitoring and troubleshooting
- Compliance
Container Security Technology Trends
The container security space continues to grow, and everyone wants a slice of the pie. We will see even more new technology disrupt the container market with the emergence of serverless, once stateful systems are supported or no longer needed.
The choices are plentiful, but these tools seem to be the most widely adopted and supported in the industry. Regardless of the public cloud provider your organization utilizes, this is a game of innovation, integration and scale.
Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in
connection with such information, opinions, or advice.