Upload File

powerpoint presentation · 3/12/2019  · docker run –rm –it –p 127.0.0.1:1337:80 alpine how...

  • Home
  • Documents
  • PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints
54
1 Docker security 12.03.2019

Upload: others

Post on 20-May-2020

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

1Docker security

12.03.2019

Page 2: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Docker world

Containers VS Virtual machine

Security concerns

Conclusion

Agenda

Page 3: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Whoami

➔M.Sc Computer Security

➔M.Sc Software Development

➔Worked previously as an embedded software developer

➔ Actually working at ImmunIT

➔ Pentesting➔ Secure coding training➔ Security awareness training➔ Social Engineering➔ Project Management➔ R&D developer

Page 4: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

4Docker security

Page 5: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

ContainerizationOperating-system-level virtualizationExecution environment virtualization

Page 6: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 7: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 8: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

What is docker?

Page 9: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Why using docker?

➔ Isolate services

➔ Simplify micro-services enhancement and maintenance

➔ Avoid dependency issues

➔ Allow to execute untrusted code safely

➔ Reduce risks involved by a compromise

➔ etc

Page 10: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How it works?

Page 11: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Docker basics

Page 12: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Dockerfile & docker-composeDockerfile

➔ Defines a docker image

Page 13: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Dockerfile & docker-composeDocker-compose

➔ Defines a containers stack

➔ Overwrite Dockerfile behaviors

Page 14: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Orchestration

➔ Automates image buildings

➔ Automates deployment

➔ Resilient

➔Macro management

➔ Live metrics

Page 15: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationOrchestrators

Page 16: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRegistry & rancher

Page 17: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 18: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 19: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

OrchestrationRancher overview

Page 20: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

20Docker security

Containers VS Virtual Machine The millennial war

Page 21: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Virtual Machine! Containers!

Page 22: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Page 23: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Containers VS Virtual Machine

Page 24: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

24Docker security

Security concerns

Page 25: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Kernel namespace

➔ Containers process are running in their own kernel namespace

➔ Provides segregation➔ Decreases risk exposure

➔ Containers get their own network stack

Page 26: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

User namespace

➔ Best way to prevent privilege escalation attack

➔ Configured on the host level

➔ Prevent root usage

Page 27: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker notary

➔ Verify image signature

➔ Ensure integrity

➔ Avoid backdoors

➔ Cross platform

Page 28: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker notary

Page 29: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDocker bench security

Page 30: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsTraefik

Page 31: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsCoreOS

Page 32: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

ToolsDockscan

Page 33: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control Management

Page 34: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementSeccomp

Page 35: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementSE Linux

Page 36: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Container hardening & Access Control ManagementApp Armor

Page 37: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsVolume vs mount vs tmpfs

Page 38: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsWinner is volume

➔ Easier to back up

➔ Can be managed through the docker CLI

➔ Cross-platform

➔ Safe sharing

➔ Remote volume

➔ Data encryption (LVM, LUKS)

Page 39: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsWinner is volume

➔ Avoid mounting sensitive folder

➔ Use ro flag when needed

Page 40: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsPrivileged container

--privileged is evil

➔ Privileged container run as a proper OS

➔ Can modify interfaces / iptables

➔ Access host devices

Page 41: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsSecurity opt

Page 42: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsNetwork namespace

Page 43: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

FlagsNetwork namespace

➔ Use dedicated networks

➔ Isolate containers on separated networks

➔ Create networks for exposed containers

➔ Segregate and segment networks as your own internal network

Page 44: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Ports exposure

➔ Control services exposure

➔ Do not expose unnecessary ports

Page 45: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Ports exposure

EXPOSE keyword is overwritten by –p flag at runtime

Docker run –rm –it –p 0.0.0.0:1337:80 alpineDocker run –rm –it –p 127.0.0.1:1337:80 alpine

Page 46: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attack

Page 47: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacks

By default, a container has no resource constraints and can use as much of a given resource as the hosts’s kernel scheduler will allow

Page 48: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacksMemory usage

Page 49: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

How to avoid Denial of Service attacksCPU usage

Page 50: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

50Docker security

Conclusion

Page 51: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Best practices

➔ Harden your containers

➔ Isolate your containers

➔ Keep up to date the underlying operating system

➔ Use security tool to monitor your containers

Page 52: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

Conclusion

Consider your containers as any physical machine and ensure their compliance towardsyour company security policies

Page 53: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

53Docker security

Page 54: PowerPoint Presentation · 3/12/2019  · Docker run –rm –it –p 127.0.0.1:1337:80 alpine How to avoid Denial of Service attack By default, a container has no resource constraints

54Docker security

QUESTIONS ?


WordPress Multi Sites - Agence 404 · La Cantine 29/09/2016 3 Préparation pour une installation locale 127.0.0.1 meetup1.wpnantes.org 127.0.0.1 meetup2.wpnantes.org Fichier hosts

Rådgivende Biologer AS 1337

TELEPÜLÉSRENDEZÉSI ESZKÖZEI RÉSZLEGES ......2 Jászkarajenő településrendezési eszközeinek részleges módosítása 1332/1, 1332/2, 1333, 1337/3, 1337/2, 1337/32, 1337/33,

1337, 25/10/2013

1337 001 - arpanel.eu

1337 Arts Guide

cs.lamar.educs.lamar.edu/faculty/foreman/Fall07/1337 CS II/1337 General Information...  · Web viewAbsolute Java, 3rd ed., Savitch . COSC 1337 Example Booklet (Kampus Korner Bookstore)

Dịch%vụ%email%sử%dụng%phần%mềm% …...trunghq@ubuntu:~$ telnet 127.0.0.1 25 SMTP Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 ubuntu.localdomain

MANSA MUSA 1280-1337 AP WORLD HISTORY - UNIT 3. MANSA MUSA, 1280-1337

Listas pilas colas_carlos_rosario10-1337

Investigation of Airfield Runways at Jacksonville …onlinepubs.trb.org/Onlinepubs/trr/1992/1337/1337-007.pdfTRANSPORTATION RESEARCH RECORD 1337 51 Investigation of Airfield Runways

127.0.0.1/atletica 2010/pr class t - ABRUZZODICORSA.IT · Title: 127.0.0.1/atletica_2010/pr_class_t.php Author: Administrator Created Date: 6/11/2017 7:35:10 PM

mpadv01-20200625134943 · 2020. 7. 1. · DIN EN 1337-5 2005-07 DIN EN 1337-6 2004-08 DIN EN 1337-7 2004-08 DIN EN 1337-8 2008-01 DIN EN 1337-9 1998-04 Ausstellungsdatum: 03.06.2020

The Hundred Years’ War 1337-1453. 1337-1453 Edwardian War 1337-1453 Edwardian War 1337-1453 Caroline War 1369-1389 Caroline War 1369-1389 Lancaster War

adiario - 1337

SIST EN 1337-1:2001 - SIST EN 1337-1:2001 · Ta slovenski standard je istoveten z: EN 1337-1:2000 SIST EN 1337-1:2001 en 01-april-2001 SIST EN 1337-1:2001 SLOVENSKI STANDARD

Mitsubishi 1337

Periódico Visión E-1337

House Enrolled Act 1337

Giotto 1267-1337

Stoletá válka 1337 - 1453

Presentación proyecto Itinere 1337

1337 5p34k

Scan18-09-13 1337

STOLETÁ VÁLKA 1337 - 1453

Πολιτεία 1337

Job Description 1337

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...=GK JYVCbXCbA PullPayload bypassSOP rebind.com x.x.x.x rebind.com 127.0.0.1 Attack rebind.com 127.0.0.1 DNSChanged Same

LAN Authentication Client Tested Solution host 127.0.0.1 key awplus-local-radius-server aaa group server radius Internal server 127.0.0.1 aaa authentication auth-Web default group

FF 2021 1337

Emoticones, Xat & 1337 sp34k

Denial of Spectrum Denial - Spectrum Authority

Giotto (1266/7- 1337)

prEN 1337-1.pdf

Boletim Informativo FAEP #1337