Freely subscribe to our NEWSLETTER

StackRox released its inaugural report, “The State of Container
Security” which found that most organizations do not feel prepared to adequately secure cloud-native applications, despite the surging adoption of containers and
Kubernetes.

The StackRox report aimed to understand how container and Kubernetes adoption trendsintersected with security concerns — how prepared organizations felt to handle
security, how the environments in which they were running containers affected
security, and who in the organization bore the greatest responsibility for container
security. Notable findings from “The State of Container Security” report
include:

– More than a third of organizations with concerns about their container
strategy worry that their strategies don’t adequately address container
security
– An additional 15 percent believe their strategies don’t take seriously
enough the threat to containers and Kubernetes deployments
– More than one-third of respondents haven’t started or are just creating
their security strategy plans

Digging into the sources of concern over container security, survey respondents
focused on misconfigurations and runtime security as their primary sources of
concern:

– Fifty-four percent of respondents said risks driven by misconfigurations and
accidental exposures is their primary concern
– A near majority of respondents, 44 percent, indicated that runtime, vs. build
and deploy, is the phase they are most concerned about from a security
perspective

Despite the concerns over the runtime phase of the lifecycle, the dominance of
concerns over misconfigurations is likely the result of a number of recent
high-profile attacks and exposures on Kubernetes deployments, such as the
cryptomining attack on Tesla’s deployment on Amazon Web Services and Shopify’s
publishing of the risk of Kubernetes metadata exposure.

Infrastructure portability is often cited as one of the top reasons to run
containers and Kubernetes, and the StackRox report highlights the dominance of
hybrid deployment. A surprising percentage of respondents are running their
containerized applications only on premise, however:

– Seventy percent of respondents overall are running containers on premise, with
32 percent running only on premise
– About 40 percent of respondents are running containers in hybrid environments,
both on premise and in the cloud
– Just under 30 percent of respondents are running only in the cloud

As for who in the organization should take lead running container security, DevOps
and DevSecOps top the list.

The report demonstrates that containers provide an impetus and an opportunity to
build a stronger bridge between DevOps and security. Results reveal that deeper
container security planning, further integration among DevOps and security teams,
and the more widespread adoption of key security technologies are necessary to
increase the holistic security of containers and Kubernetes deployments. The
complete report provides a number of conclusions that outline key implications for
organizations in need of a stronger container security strategy and the specific
security elements they need to meet enterprise objectives.