The future of high-performance and secure cloud computing is in containers. Lightweight cloud containers are fast replacing resource-sucking virtual machines, and Kubernetes is fast becoming the de facto standard for container orchestration.

If you are using containers, however, you may be exposing users and applications to security threats or non-compliance penalties. Here, we’ll discuss how Kubernetes containers work and best practices for using them safely.

What Are Kubernetes Containers?

In cloud computing, a container is a small virtual instance of a system or application that runs within a specific technical framework. Based off the idea of system virtualization, containers make that process more optimized by minimizing the resources need to launch container services. So, for example, instead of having an entire virtual operating system, you have several smaller components operating within virtual systems that can be managed, opened, closed or changes as they run.

Containers therefore address specific challenges of massive app development by:

1. Minimizing the use of centralized resources and bottlenecks.
2. Optimizing application execution by using smaller components that can be updated, patched, changed or decommissioned as needed.
3. Centralizing controls like operations, updates, security policies and compliance standards through an orchestration platform.

The last of these items (orchestration) rely on software platforms that can schedule operations between container clusters (called nodes) so they work as a larger application. This, in essence, is what Kubernetes is: an orchestration platform for containers. Created by Google and, after years of development, released as free and open source technology, Kubernetes is deployable on platforms from the major cloud providers (Google, Microsoft and Amazon).

One of the major challenges facing Kubernetes that we will focus on here is security. Kubernetes is not inherently insecure, but it also isn’t secure by default, even if it is hosted by, managed by, and running on one of the Big Three cloud service providers. Your CSP is responsible for security of the cloud, and your organization is responsible for security in it.

What Are Best Practices for Managing Kubernetes Systems Securely?

While a incredibly technical undertaking, Kubernetes management is also incredibly common, and securing these platforms is a crucial part of business leadership’s job. CISOs or CIOs must understand what their IT teams or security vendors are doing to manage their applications in the cloud, and Kubernetes security may be part of that.

If you are consulting with your IT team or IT vendor regarding Kubernetes security, consider these best practices:

• Run the latest version and keep it patched. The only realistic fix for the Kubernetes security privilege escalation flaw was to update Kubernetes. Patches for the latest version are released every quarter, and they often include important security fixes, so make sure you keep up with them.
• Maintain maps of Kubernetes clusters and update regularly. As workloads increase and more clusters are deployed to handle them, cluster sprawl sets in, and ignoring this problem won’t make it go away. Your IT support should understand, from top to bottom, how your cluster nodes work together, the potential security challenges there, and how to manage, update and audit them regularly.
• Use role-based access control (RBAC). Use RBAC to control user access and permissions on your Kubernetes API, and always use the principle of least access; give employees as much access as they need to perform their jobs, and no more. Use namespace-specific permissions instead of cluster-wide permissions. Instead of giving users cluster admin privileges, grant temporary admin access only as needed. RBAC is enabled by default in Kubernetes 1.6+, but check to make sure, especially if you upgraded from an earlier version of Kubernetes. Your old configuration may have carried over.
• Consider Attribute -Based Access Controls (ABAC). If you work in specific industries or even in governmental roles where data access to items like classified information or CUI are common, further refinement with granular ABAC controls could be called for. ABAC gives you more ways to control file and resource permissions and remain compliant.
• Work with expert security vendors with Kubernetes and container compliance experience. Securing the cloud is different than securing an on-prem environment, and securing containers is different than securing a non-container system. Even though Kubernetes removes some of the headaches of cloud container management, container environments are still complex, dynamic and have a lot of moving parts. Container security is difficult, especially since new threats and vulnerabilities emerge every day. Organizations must also ensure that their configurations and security controls adhere to applicable compliance requirements. For example, some compliance standards require certain highly sensitive workloads to be isolated in a different machine or hosted on-prem.

Continuum GRC: Streamline Security and Compliance with Kubernetes and Cloud Applications

Modern software development and Managed Services (MSP) are increasingly relying on modular cloud architecture to build our digital world. This fact means that security and compliance are at the forefront of effective deployment. If you are building cloud applications using Kubernetes or other container orchestration systems, Continuum GRC can help streamline compliance and security with regular, comprehensive audits. Our ITAM system can help automate framework-specific audits, and our security excerpts can provide the kind of support you need to address challenging or unique compliance issues.

Ready to Secure and Harden Your Kubernetes Systems?

Call Continuum GRC at 1-888-896-6207 or complete the form below.