3 Pillars of Intent-Based Security for Containers
February 01, 2017

Ben Bernstein
Twistlock

The concept of intent-based security is a new way of looking at applications, specifically those in a containerized environment, down to the application level and adding in extra security. It uses the power of the developer in order to produce a more predictable and secure environment that can be enforced.

To elaborate, today there is more information flowing from the developer. Historically, when developers wrote their code, if you asked them which processes are running in the operating system where their code is running, they would have no idea. Conversely, if they develop a container-based application, they know exactly which processes are running, because they produced the entire container stack top to bottom. Developers must be able to describe the entire OS stack in order for their containers to run. This enables everything to be more automated and it typically results in everything being delivered in small frequent pieces and updates.

When it comes to DevOps and containers, the unique nature of the process and technology allows the intent-based security model to capitalize on three pillars:

1. Containers are declarative

When a developer writes the code, he/she does not just write the code, he/she writes a manifest that describes how this code should work and how it should interact with its environment. While the developer does not provide you with a real security manifest, you can translate the extra information that you have and try to create a security profile. With containers you have dockerfile, you might have a pod, you might have an application group if you're running on top of mesosphere. There is a lot of information in the system that you could use in order to understand what is supposed to happen.

2. Containers are predictable

When you look at containers, they contain less specific logic and more common building blocks because containers are typically made out of layers you download that someone else created.

For example, if you're creating a container, you don't write the OS from scratch, you take an Ubuntu. If you're using MySQL, then you'll just take a MySQL layer and put it in your container. And then if, on top of that, it's just a database and you want to add a thin layer of configuration, you've got Ubuntu, MySQL and on top of that a little bit of configuration. That's a pretty predictable piece of software. It's very minimalistic, there's not a lot of logic in it and it's built out of common building blocks. So you could basically assume what that piece is supposed to do. But even if it wasn't just configuration and there was some logic in it, it would contain less logic than a virtual machine would because it's a microservice. Baselining behavior based on a more minimalistic microservice is much easier than it was in the case of virtual machines.

3. Containers are immutable

In the past, it was hard to understand if something happening with the application was really an attack or not. In the case of containers, whenever you patch a container or change its real intent, it should not happen in real time. What happens is the developer changes things and then he/she pushes in a new version. He patches the OS or adds new functionality and then pushes in a new container and scratches the old one. This gives you a lot of power from a security standpoint because, for the first time ever, if you see a polymorphic change in the behavior of the application (if it starts behaving differently) it's either a configuration drift, which is bad, or a real attack. And depending on the other indicators, you can understand if you're seeing an event that looks like an attack or not.

Leveraging these three pillars, there is a powerful opportunity to use whitelisting, for example, to approve known good processes. In combination with application intent analysis, enforcement measures help to support the intent-based security model and preserve the original intent of the application.

Ben Bernstein is CEO and Co-Founder of Twistlock.

The Latest

February 21, 2017

The stakes are high for preventing security compromises: 72.7 percent of companies have a custom application that, if it were to experience downtime, would significantly impact the organization’s ability to operate, according to the Custom Applications and IaaS Report 2017 ...

February 16, 2017

Developers and testing professionals intend to speed up build deployment times even further — as 28 percent of those surveyed say they want to deploy hourly (up from 18 percent in 2016) — according to an independent survey, Testing Trends in 2017: A Survey of Software Professionals ...

February 14, 2017

Everybody loves DevOps. In fact, DevOps is the hottest date in IT. That's because DevOps promises to satisfy the deepest longings of digital business — including fast execution on innovative ideas, competitively differentiated customer experiences, and significantly improved operational efficiencies ...

February 13, 2017

Integration is no longer your IT department’s problem; it is everyone’s problem. With the IoT, APIs, blockchain and chatbots thrown into the mix, everyone needs to integrate with everything. And this is leading to companies who are partnering with integration vendors to ensure their success as they adopt these, and other disrupting technologies, in the future ...

February 09, 2017

If you're thinking about implementing Application Release Automation (ARA), here are some tips to get started ...

February 07, 2017

IT leaders need to be able to manage application development at scale using a factory metaphor that requires lots of instrumentation. The challenge is that, in the case of applications, the actual products being manufactured consist of as much art and craft as they do science. Optimizing the application release cycle requires adding a layer of software abstraction above and around the application development process that serves to make the overall process more efficient without adding more friction ...

February 03, 2017

While DevOps and continuous delivery models can (in theory) accelerate technology projects and help them run more smoothly and predictably, the required cultural realignment can prevent companies from reaping the full benefits. Developing and executing an effective strategy means shifting how teams collaborate and interoperate — and we all know how everyone loves change. Here are four steps that enterprise IT leaders are undertaking to facilitate the cultural adaptation and collaboration required to maintain IT and business agility ...

February 01, 2017

The concept of intent-based security is a new way of looking at applications, specifically those in a containerized environment, down to the application level and adding in extra security. It uses the power of the developer in order to produce a more predictable and secure environment that can be enforced. When it comes to DevOps and containers, the unique nature of the process and technology allows the intent-based security model to capitalize on three pillars ...

January 30, 2017

Agile software development methods were introduced less than a decade ago, but their popularity has seen a steady rise. However, according to Zephyr's annual How the World Tests report, while a large number of the companies are adopting agile testing methodologies, they face a fair number of obstacles in successful adoption. Here, we’ll cover the key findings of that report and what they mean for those looking to adopt an agile testing process ...

January 27, 2017

"DevOps" may not appear on most enterprises' organizational charts, yet it's having a significant impact on the design of their IT architectures, driving the rise of the low code development, and permanently re-shaping the roles and responsibilities of IT organizations ...

Share this