Kubernetes security tools give enterprise IT shops strategic approaches to container security that go beyond shoring up individual container instances.
Kubernetes security tools have proliferated in 2018, and their growing numbers reflect increased maturity around container security among enterprise IT shops.
The latest additions to this tool category include a feature in Google Kubernetes Engine called Binary Authorization, which can create whitelists of container images and code that are authorized to run on GKE clusters. All other attempts to launch unauthorized apps will fail, and the GKE feature will document them.
Binary Authorization is in public beta. Google will also make the feature available for on-premises deployments through updates to Kritis, an open source project focused on deployment-time policy enforcement.
Aqua Security also added to the arsenal of Kubernetes security tools at IT pros' disposal with an open source utility, called kube-hunter, which can be used for penetration testing of Kubernetes clusters. The tool performs passive scans of Kubernetes clusters to look for common vulnerabilities, such as dashboard and management server ports that were left open. These seemingly obvious errors have taken down high-profile companies, such as Tesla, Aviva and Gemalto.
Users can also perform active penetration tests with kube-hunter. In this scenario, the tool attempts to exploit the vulnerabilities it finds as if an attacker has gained access to Kubernetes cluster servers, which may highlight additional vulnerabilities in the environment.
Fernando Montenegro
These tools join several other Kubernetes security offerings introduced in 2018 -- from Docker Enterprise Edition's encryption and secure container registry features for the container orchestration platform to Kubernetes support in tools from Qualys and Alert Logic. The growth of Kubernetes security tools indicates the container security conversation has shifted away from ways to secure individual container images and hosts to security at the level of the application and Kubernetes cluster.
"Containers are not foolproof, but container security is good enough for most users at this point," said Fernando Montenegro, analyst with 451 Research. "The interest in the industry shifts now to how to do security at the orchestration layer and secure broader container deployments."
GKE throws down the gauntlet for third-party container orchestration tools
The question for users, as cloud providers add these features, is, why go for a third-party tool when the cloud provider does this kind of thing themselves?
Fernando Montenegroanalyst, 451 Research
Google's Binary Authorization feature isn't unique; other on-premises and hybrid cloud Kubernetes tools, such as Docker Enterprise Edition, Mesosphere DC/OS and Red Hat OpenShift, offer similar capabilities to prevent unauthorized container launches on Kubernetes clusters.
However, third-party vendors once again find themselves challenged by a free and open source alternative from Google. Just as Kubernetes supplanted other container orchestration utilities, these additional Kubernetes management features further reduce third-party tools' competitiveness.
GKE Binary Authorization is one of the first instances of a major cloud provider adding such a feature natively in its Kubernetes service, Montenegro said.
"[A gatekeeper for Kubernetes] is not something nobody's thought of before, but I haven't seen much done by other cloud providers on this front yet," Montenegro said. AWS and Microsoft Azure will almost certainly follow suit.
"The question for users, as cloud providers add these features, is, why go for a third-party tool when the cloud provider does this kind of thing themselves?" Montenegro said.
Aqua Security's penetration testing tool is unlikely to unseat full-fledged penetration testing tools enterprises use, such as Nmap and Burp Suite, but its focus on Kubernetes vulnerabilities specifically with a free offering will attract some users, Montenegro said.
Aqua Security and its main competitor, Twistlock, also must stay ahead of Kubernetes security features as they're incorporated into broader enterprise platforms from Google, Cisco and others, Montenegro said.
Fernando Montenegro
