Hybrid Cloud Security
Data Center & Virtualization
Security Fit for DevOps
Solutions for Security Teams
Advanced Threat Protection
Endpoint & Gateway Suites
SaaS Application Security
Endpoint Detection & Response
Point of Sale
All Products and Trials
Centralized Visibility & Investigation
Global Threat Intelligence
Connected Threat Defense
Breaking News & Intelligence
Simply Security Blog
Security Intelligence Blog
UK Security Blog
Education & Certification
Glossary of Terms
Research & Reports
The Deep Web
Internet of Things (IoT)
Zero Day Initiative (ZDI)
Login to Support
Virus & Threat Help
Renewals & Registration
Free Cleanup Tools
Find a Support Partner
Pre-Sales Technical Advice
For popular products:
Find a Partner (Reseller, CSP, MSP)
Become a Partner (Reseller, Integrator)
All Alliance Partners
Customer Success Stories
Corporate Social Responsibility
Diversity & Inclusion
Internet Safety and Cybersecurity Education
Find a Partner
1-877-218-7353(M-F 8-5 CST)
Learn of upcoming events
Social Media Networks
+44 (0) 203 549 3300
Virtualization and the cloud are a boon for developers and businesses that create applications. Virtual infrastructures give businesses and developers cost-effective, dynamic, and agile ways of providing their products and services or deploying their own applications. With the public cloud expected to grow into a US$178-billion market this year, there’s an evident shift toward automation and scalability in pushing out applications.
But as businesses and developers strive to move faster to keep pace with deadlines and demand, security lags behind and, more often than not, is skimped on. A 2017 survey by the SANS Institute, for instance, reported that 15 percent of organizations succumbed to data breaches due to unsecure applications in the past two years, and as many as 10 percent of organizations said that no security testing at all was being done on their mission-critical applications.
[RELATED: Mobile App Security for Developers]
Securing virtual environments is no different from safeguarding the applications themselves. Here are some considerations and best practices that developers, IT operations professionals, and system administrators should take into account in securing the infrastructures that power the applications they use.
Preventing security gaps in containers and virtual machines
Having differing scopes and requirements in their workloads, organizations use virtualization technologies according to their respective needs. For example, virtual machines (VMs) are a better fit for developers and enterprises looking for flexibility in running multiple applications, while containers are better for those requiring scalable applications.
Containers and VMs both offer means by which applications can be run multiple times or isolated within a single platform, but they differ in how they do it. Containers virtualize an operating system (OS) to run various workloads in a single OS instance, while VMs virtualize hardware to run instances of the OS.
Thus, every instance of applications running on containers and VMs poses a potential attack vector if it is vulnerable or misconfigured. An instance running with unnecessary ports still set up on the container or VM, for example, can be exploited to let hackers sneak into the application’s server.
Container images must also be vetted for vulnerabilities. They are constantly added to a repository, overwritten, and rehashed (if open-source) — actions that increase the risks of their having security flaws. The SANS Institute’s checklist for auditing Docker-based containers is a good starting point for assessing containerized applications and host OSs.
[RELATED: What are serverless applications, and what do they mean in DevOps?]
The hypervisor manages how guest OSs access resources such as the central processing unit (CPU), memory, network, and storage. It partitions the resources to prevent the instances from intruding into one another’s resources. The hypervisor is the underlying infrastructure behind applications running on VMs, which makes their security of paramount importance. The U.S. National Institute of Standards and Technology has detailed recommendations for securing the hypervisor:
[InfoSec Guide: Mitigating Web Injections]
Images are the blueprint of containers, which use them to spin or run applications. A vulnerable image begets a malware- or hacking-prone container, and consequently, the application itself becomes prone to malware or hacking as well. Identifying security gaps (such as unsecure code) pre-runtime and fixing them accordingly before the image is scheduled in an orchestration environment will significantly save time and effort reworking on builds, as well as reduce overhead and disruptions in the application’s life cycle:
Experts predict that this year, intelligent enterprise resource planning-based (i-ERP) applications, which are typically hosted on cloud platforms and designed to manage and automate business processes, will be the benchmarks that 15 percent of Global 2000 enterprises will use to improve their bottom lines and enrich customer experience. Indeed, virtualization and the cloud are increasingly transforming the ways personal and mission-critical data are handled and processed.
But it’s not just about securing containers and VMs. Regardless if an organization’s workloads are under the physical, virtual, or cloud infrastructures (or any combination thereof), maintaining and securing them can be daunting. True to the DevOps culture, streamlining is the name of the game. Whether using virtual machines or containers (or both at the same time) to test, run, and deploy applications, their security shouldn’t be a roadblock. Incorporating security into the very infrastructures that drive applications to work not only helps thwart threats, but also reduces business risks to organizations.
Like it? Add this infographic to your site:1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.