The most recent incidents have leveraged insecure container engines as the attack point. Compromising a container host via a vulnerability and introducing containers with malicious code. PROGRAMS SIMILAR TO GRABOID CODEHow Do These New Container Threats Work?Īt a high level, attackers find a weak point in the container pipeline and introduce the malicious code into a container image. While the security implications are alarming, in elastic public cloud environments these incidents have financial implications as well. When Cryptomining is done without authorization it is referred to as Cryptojacking. This week saw news of self-propagating worms in the container landscape to perform unsanctioned computation tasks such as Cryptojacking. This year saw new frontiers in the container threat landscape with attacks on the ecosystem ( Docker Hub breach, DockerHub Malware). Qualys threat research has been tracking developments ( 1, 2, 3, 4) in the container threat landscape given the widespread usage of containers and the risks the container attack surface poses to enterprises. Best intentions of developers, devops teams not withstanding it does require a well thought out security strategy to think through the attack surface for containers and put in place a security program/tooling to address related risks. This has been driven mainly by development, devops teams for reasons relating to development velocity & infrastructure utilization/efficiency.Īs with any new technology, the security conversations often lag technology adoption. This blog post is intended for Qualys customers and partners to understand how such container attacks work, provide security best practice recommendations & walkthrough related Qualys product portfolio functionality.Ĭontainers usage is mainstream today and enterprises are leveraging containers for their workload deployments across a number of different types of private and public cloud infrastructure. This week saw news of self-propagating worms in the container landscape to perform unsanctioned computation tasks such as cryptojacking.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |