What are the most effective security controls for containerized applications?

1 Secure the host

The host is the machine or platform that runs the containers. It is essential to secure the host by applying the principle of least privilege, hardening the operating system, and using tools such as firewalls, antivirus, and intrusion detection systems. You should also monitor the host for any suspicious activities or anomalies, and isolate it from other networks or devices that are not related to the containers.

2 Secure the images

The images are the files that contain the code and dependencies of the applications. They are used to create and run the containers. You should secure the images by using trusted sources, scanning them for vulnerabilities, and signing them with digital signatures. You should also avoid storing sensitive data in the images, and use encryption and access control mechanisms to protect them.

3 Secure the containers

The containers are the instances of the images that run the applications. They are isolated from each other and from the host, but they can still communicate through networks or shared volumes. You should secure the containers by using the latest and minimal versions of the images, limiting their privileges and resources, and applying network policies and segmentation. You should also update and patch the containers regularly, and delete them when they are not needed.

4 Secure the orchestration

The orchestration is the process of managing and coordinating the containers across multiple hosts or clusters. It involves tools such as Kubernetes, Docker Swarm, or Mesos, that automate the deployment, scaling, and recovery of the containers. You should secure the orchestration by using strong authentication and authorization, encrypting the communication and data, and auditing the actions and events. You should also configure the orchestration tools according to the best practices and standards, and review them periodically.

5 Secure the data

The data is the information that is processed, stored, or transmitted by the applications. It can be in different formats, such as files, databases, or streams. You should secure the data by using encryption, masking, or tokenization, and applying data classification and retention policies. You should also implement data backup and recovery plans, and comply with the relevant data protection regulations and standards.

6 Secure the DevOps

The DevOps is the culture and practice of integrating the development and operations of the applications. It involves tools and methods such as continuous integration, continuous delivery, and continuous monitoring, that enable faster and more reliable delivery of the applications. You should secure the DevOps by adopting a security-by-design approach, implementing security testing and scanning, and using secure coding and configuration management. You should also foster a security-aware culture and collaboration among the developers and operators.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?