10 reasons why securing software supply chains should start with containers

Containers And Kubernetes are painting challenges For multi-cloud application development, And they are Also among THE less protected of any of them areas of software provide Chains. Kubernetes orders 92% of THE container orchestration platform walk, despite DevOps teams seeing he as A less secure container platform has to use. It is become THE of facto standard For container platforms due has It is portability, Open source architecture, ease of to use And scalability.

THE Cloud Native Computing Foundations' recent Kubernetes report find that 28% of organizations to have more that 90% of workloads running In precarious Kubernetes configurations. THE majority of workloads, more that 71%, are running with root to access, increasing THE probability of system compromises And sensitive data be exposed. A lot DevOps organizations neglect setting readOnlyRootFilesystem has TRUE, which leaves their containers vulnerable has attack And unauthorized executables be writing.

Containers are THE the fastest growth – And the weakest link – In software provide chains

Gartner predicted that by 2029, more that 95% of companies will be running containerized apps In production, a major leap Since less that 50% last year. In five years, 35% of all business apps will run In containers, And more that 80% of commercial off the shelf (COTS) sellers will offer their software in container format, to the top Since less that 30% last year. Containers And their orchestration platforms are domineering DevOps And DevSecOps through companies create cloud applications, And It is while going has accelerate.

Containers are among THE the weakest connections In software provide Chains, However. From poorly configured cloud, container, And network configurations has confusion on WHO possesses container security on THE life cycle of A project, organizations are in trouble has get container security below control. Attackers are capitalize on THE disconnects by operator growth vulnerabilities In container pictures, execution times, API interfaces And container registers. Not guaranteed containers with light identify security, if any of them has all, are A gold mine For initiated the attackers, Also.

When container pictures are not secure, attackers can quickly move beyond THE initial threat surface And infringe entire networks And infrastructure. Most attacks are not identified For A average of 277 days And can go longer depending on, depending on how effective A the organization monitoring East Or not.

From picture vulnerabilities has precarious container Duration configurations And vulnerabilities In Duration software, containers often fail due has weak Or inconsistent configuration. There East No Single solution on THE walk that solves all these challenges; he takes change management In DevOps, DevSecOps And software engineering has help improve container security.

A GOOD place has to start East with NIST Application Container Security Guide (NIST P.S. 800-190). He provides A in depth assessment of THE potential risks related has containers And provides practical recommendations For reduce their risks. According to has NIST, "THE to use of containers changes a lot of THE responsibility For security has developers, SO organizations should ensure their developers to have all THE information, SKILLS, And tools they need has TO DO her the decisions." NIST recommended that security teams be activated has define And execute quality all along THE development ride a bike.

Get container specific security tools In place First of all. Define A affordable, feasible roadmap of security tools specially built has protect containers if A East not Already In place. Security teams to start with tools that are designed has manage vulnerabilities, impose to access controls, And ensure compliance. Examples include tools as Red Hats Clear For vulnerability scanning, Anchor For Kubernetes picture scanning And analysis And OpenSCAP For compliance checks. Impose strict to access controls. For any of them organization pursue A zero trust frame, application THE less privileged to access has each container East essential For reduce THE risk of A infringe. That especially applies has administrator to access ...