Most of the business applications today are enabled by the cloud with a lot of them residing as containerized workloads. Digital transformation is being powered by concepts encompassing containers, Kubernetes, and microservices and has become indispensable parts of how applications are developed & deployed.
If we take containers particularly in consideration, they are modernizing applications like never before and helping in creating scalable & agile cloud-native applications. Even though companies are adopting containers at a fast pace, operating them in production will need a steep learning curve.
As per Gartner, by 2022 a whopping 75% of the organizations will be using containerized applications in production, up from 30% in 2019.
But this is not the entire story. Companies still need to mature in their adoption of container and one of the key areas of concern is security, especially that of the data and that will be the focal point of this blog.
What are Containers?
Container technologies like Docker and orchestration frameworks like Kubernetes administer a standardized way to package applications along with the code, runtime and libraries so that they can run consistently across the software development lifecycle.
The biggest advantage – You can run your application reliably when moved from one computing environment to another. The environment could be anything from a developer’s laptop, test environment or from staging to production. You can even move the application from a physical machine in a data center to a virtual machine in the cloud.
For instance, think about Google Maps! The moment you search for a fresh location on your mobile application, the cloud service constructs a new container to manage the workload. Now imagine the number of times people search for locations on Google Maps on a particular day – that’s a lot of containers!
So why containers? Traditionally workloads and applications had to be built from scratch if there was a need to migrate to another environment. Containers solved this problem with the concept of “isolation”. They are lightweight software components that package the application along with its dependencies & configurations in an isolated environment on a traditional OS, traditional server.
“Isolation” is important here. Isolation delivers-
- Speed – containers can be deployed much faster than virtual machines as they are smaller entities.
- Responsiveness – shorter start-up times
- Portability – They can be moved between different platforms & cloud vendors.
The reason why the industry has been so excited about containerization is the flexibility they offer and the faster pace of application development that comes with it. Containers and orchestration engines like Kubernetes are paving the way for a new era of application development where modern concepts like microservices and continuous development and delivery are the new normal.
What is Container Security and why is it being talked about?
The flexibility we just spoke about also leaves containers susceptible to security risks. On one hand, containers have transformed the way applications are built & scaled and on the other, this has given rise to challenges around security, storage, and networking.
You can’t possibly wait until you go into production to integrate a container security solution. It will nullify the advantages gained from DevOps processes when deployments are delayed because of security matters popping up at the end of the development cycle.
Let’s take a look at some of the findings in the State of Container and Kubernetes Security Report, 2020.
About half of the respondents said that they had to delay an application rollout because of a security issue.
Container technology is one of the major drivers of IT innovation & digital transformation. However, the fact that 44% of respondents agreed that they had to delay application deployments into production because of a container security issue indicates an aching fact – organizations are unable to tap into its biggest benefit i.e. faster app delivery.
Almost all the respondents came across security incidents in Kubernetes & Container environments
In the past 12 months, 94% of the companies surveyed experienced a security-related event in their Kubernetes & container environments in the last 12 months. Out of these, the majority of them reported misconfigurations in their environments as the top reason for this.
94% is a lot! That statistic in itself highlights the importance of container security. As containers evolve and organizations embrace them for deployments, unforeseen challenges often come up which organizations are often not prepared for. Things change in the production environment and organizations are stuck with how they should go about troubleshooting problems. They often do not understand how to monitor them or how to design SLAs around containers that were traditionally done for legacy applications.
Security appears to be most challenging in this regard as organizations ask questions like – How do I protect my data? Internal security teams are often puzzled about how to address these security issues in containerized environments since there’s a lot of change in the cultural and process aspects. What makes things more challenging is the fact that there is no security by default in containers and security teams have to exclusively define everything pertaining to security.
Data Encryption: A key aspect of Container Security
Security problems can occur in containers in a number of different ways. As we have seen in the aforementioned study, misconfigurations have been the top reason for these security incidents. Container security often comes under scrutiny because of improperly configured containerized environments. This leaves room for attackers to install malicious software that can take over the entire container environment. There are also concerns about whether containers have vulnerabilities within.
Why data security?
Data Security is another major challenge and data integrity is one of the top priorities for containers. Enterprises have a deluge of highly valuable & confidential data residing in container environments. This means that a security breach can have detrimental effects on both the company and its customers.
Even though companies are using techniques like access control, monitoring, security policies which are basically the top-line defense. But once a security breach passes all these doors, it will reach to where the maximum value lies – the data. This is where Encryption comes into play and can keep it insulated while protecting the organization
There is one key aspect to Encryption that is often overlooked but is extremely important is the Encryption key. Remember that the encryption key cannot be stored at the same place – be it a server or node, as the data itself.
Why can’t we just encrypt containerized data like we’ve always done?
Encryption in containers does not come easy and is not a one-size-fits-all approach. To begin with, you can use Docker Secrets but it does not suffice if you’re using other container products. That will require you to investigate other encryption options as different container products will need different encryption options.
The second aspect is that traditional encryption technologies would not suffice in a containerized environment. One has to remember that transforming an application with containers involves leaving behind legacy applications and embracing modern concepts to fuel digital transformation like microservices, cloud, DevOps etc.
Security teams cannot possibly just lift an old technology and integrate it into the containerized environment to call it container security. They would be compromising on unique relationships between the encryption data and the respective keys and it will make it even more susceptible to breaches.
Whether you’re on cloud or on-premise organizations today work on shared environments. This is especially true for containers since they can be run on any environment and there’s no one particular hardware/server they’re attached to. So, it just does not make sense to simply encrypt the hardware from the server and be done with “container security”.
A few key points to protecting containerized data
- The fact that containers work in a multi-tenant storage environment makes it difficult to achieve encryption in production environments. Encryption keys must never be shared by containers and placed in the same location as the data.
- Legacy storage management is not going to suffice as containers need to have access to various storage centers and be up and running on different hosts.
- There should be zero access to security details for developers and platform operators and yet it should not hamper their work.
Looking for secure, faster application deliveries? Talk to Knoldus DevOps Consultants
What matters most today is quick feedback cycles, flawless deliveries, and meeting dynamic customer requirements. Adopting a healthy DevOps strategy accelerates your software development lifecycle (SDLC), improves collaboration and increases quality by leveraging containerized hosting for faster time to market & business agility.
With our Containerized Hosting solutions you can ensure quick & accurate configurations in production, adopt multi-tenant environments to create containerized applications, and say goodbye to inconsistencies in different environments.
Reach out to us here or drop us a line at hello@knoldus.com.
