Trend Micro Cloud One^™Container Security

Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection

Security earlier

Delivers container image scanning earlier in your build pipeline, scanning new images as they’re built and providing continuous zero-day protection after images are published. Automated scanning and response provide instant feedback to your developers about the presence of threats and vulnerabilities.

Trusted enforcement

Make centralized container admission control part of your container security enforcement. Trend Micro provides policy-based management of images, allowing security teams to select and define the rules for how containers are permitted to run in your environment for Kubernetes deployed containers.

Complete protection

Automated vulnerability detection of malicious traffic and protection of your containerized applications – from build time to runtime. Gain in-depth security coverage built into your CI/CD processes to address container risks for stronger protection.

Minimum System Requirements

Kubernetes 1.8.7 or higher

Helm/Tiller 2.8.1 or higher

Docker 17.06 or higher

Complete Cloud-Native Application Security

Security teams can be assured that protection and enforcement are applied to container builds, deployments, and runtime workflows.

Provides security for Kubernetes®-deployed containers, all from one unified solution

Reduce disruption of development schedules and workflows with unmatched research, detection of threats, and non-intrusive security for the CI/CD pipeline

Designed for modern cloud-native application development and mitigates the risk associated with rapid deployments of microservices

Ensures protection and enforcement are applied to container builds, deployments, and runtime workflows

Detect threats prior to runtime

Uncover vulnerabilities, malware, and sensitive data, such as API keys and passwords, within your container images, including source-code analysis powered by Snyk

Invoke unlimited, detailed scans with recommended fixes at any stage of your pipeline
Minimize false positives by correlating patch layers with packages that are vulnerable in the same image
Address vulnerabilities before they can be exploited at runtime
Enable developers to address security bugs before deployment

Confidently deploy containers with admission control policy

Detect security issues early, enforce admission policies, and be assured only compliant containers run in production.

Build a security policy based on container image scanning and detection of secrets, keys, malware, and vulnerabilities
Allow images that only meet specific application or organization security policies to proceed through the pipeline
Select from advanced policies, such as disallowing images set as privileged containers, or allow exceptions based on names or tags
Run powerful enforcement and compliance checks, and extend Kubernetes admission control
Get support for leading cloud service providers — Amazon Elastic Kubernetes Service (Amazon EKS), and Azure Kubernetes Service (AKS)

Continuous security with container runtime protection

Enable runtime protection for all your containerized applications.

A SaaS platform for cloud-native security, including host, container, and serverless container requirements
Runtime protection deployed within the cluster, for all containerized applications within each node
Greater visibility into attempts to run disallowed commands or illegally access files
Runtime protection builds a model of expected behavior via Learning Mode
Automated management tasks and policy via code, as part of a CI/CD pipeline

Flexibility to fit into your pipeline

Effective security for containers begins with simplified administration of protecting images.

Deploy as a Kubernetes® helm chart for easy integration into your software-build pipeline
Configure authorized users and groups accordingly for role-based access
Allow or block scanned image deployments based on scanning policies or through native integration with Kubernetes object properties
Share common policies across multiple pipelines and remove the need to hard-code rules to deal with scan results
Enable developers to easily review scan results through their command line or tool suite scripting language