Containers have become a staple among large banks and financial services firms, which have used the technology in production. It has captured the attention of the broader market, that hopes to achieve the same technology benefits of improved application delivery and run-time efficiencies.

This modular plug-and-play architecture is more scalable and can deliver more power to the application in a specific area. Any technology requires a thorough security assessment to ensure associated risks are identified and weighed against an enterprise’s appetite for risk. When approaching the risk-tolerance threshold for containers, additional controls may be necessary to mitigate the risk to acceptable levels. There are essentially three broad categories of risk to consider when using containers.

1. Attack Surface

There are many different objects to track, and a noted lack of visibility into how those objects are manipulated. This means a focus on user authentication and authorization, container activity lockdown and image detection and prevention are required.

2. Shared Kernel

All applications generally share the same Linux kernel. This is one of the key benefits of containers from a DevOps perspective, since containers take seconds to run. Whereas, minutes are required to spin up and spin down a virtual machine. This places an emphasis on the integrity or assurance of the image.

3. Vulnerabilities

There is a risk that any vulnerabilities introduced during a development cycle may be exploited by attackers, including malicious insiders.

Register for the webinar, “Containers and data security: what you need to know.”

The big challenge for system architects, DevOps and chief information security officers is how to automate security. DevOps teams are running full speed with Kubernetes and deploying apps every hour of every day. The main threat vector is an attack that attempts to install an older vulnerable package or library and then exploit it.

Container Monitoring Tools

Monitoring tools should consider the behavior of typical file systems being accessed and baseline patterns of file system access. Solutions on the market leverage system calls by monitoring network packets and all activity happening on the host. The better solutions incorporate the context of a specific container to do both monitoring and interception.

To address these high-level issues, organizations running containers in production should ensure adequate controls are in place to monitor user access to containers. They should also establish a role-based, least-privilege approach. The least-privilege principle should apply to container, operating system and network resource access. It should be coupled with enforcement of runtime parameters. Monitoring should be implemented to identify anomalous container behavior, such as access and privilege escalation attempts with prevention capabilities to prevent malicious activity in real-time.

Generally, early adopters found they had limited visibility into container activity until the host has been compromised. The open-source tools often require customization. This is because they only provide partial coverage of the risk categories and often fail factor in the context of the container.

Container platforms focus on images and limit their coverage to their own stack. There is little runtime detection or prevention provided by these platform providers, although some provide policy-driven mechanisms.

These approaches can go a long way to address some of the sources of data risk, but no data security solution is a silver bullet. There may be better strategies that you should pursue. It depends on your enterprise’s risk tolerance, types of sensitive data being stored in these environments and your security team’s capacity.

The IBM Security Data Security team is running an anonymous survey to gather market feedback on customer data security needs. Take the survey (~8 minutes) to share your top priorities concerning data security and what you would like to see in a data security product.

Take the Data Security Survey from IBM Security

More from Banking & Finance

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…

SEC Proposes New Cybersecurity Rules for Financial Services

Proposed new policies from the Securities and Exchange Commission (SEC) could spell changes for how financial services firms handle cybersecurity. On Feb. 9, the SEC voted to propose cybersecurity risk management policies for registered investment advisers, registered investment companies and business development companies (funds). Next, the proposal will go through a public comment period until May 9.  The Importance of Cybersecurity in Finance The 2021 X-Force Threat Index found that financial services were the most targeted industry. Manufacturing beat out…

Top Security Concerns When Accepting Crypto Payment

From Microsoft to AT&T to Home Depot, more companies are accepting cryptocurrency as a way to pay for products and services. This makes perfect sense as crypto coins are a viable revenue source. Perhaps the time is ripe for businesses to learn how to receive, process and convert crypto payments into fiat currency. Still, many questions remain. How can you safely enable customers to pay with Bitcoin or other digital currency? What are the security risks that come with cryptocurrency? Let’s…