NeuVector Protect First: Container Security for the Federal Government

Congratulations! You’ve successfully implemented your containerization strategy and automated your application deployment with Kubernetes. Whether you have a private or public cloud, you are still at risk for threats to your virtualized environment, including:

Overview

• Ransomware extortion
• Crypto-jacking
• Data theft
• Service disruption
• Kill chain attack
• Man-in-the-middle attack

In fact, hackers are working overtime to find vulnerabilities and exploit them in managed container services. You will need next-generation security tools and multiple layers of security protection to keep up with the dynamic nature of Kubernetes and to protect you from sophisticated, never seen before attacks that cannot be prevented with scanning. You will need to continue to take best practice pipeline application actions like: Kubernetes Vulnerabilities & Attack Vectors

As an orchestration tool for containers, Kubernetes relies on pods, nodes, and services to deploy, update, and monitor containers. At the heart of Kubernetes networking, pods contain at least one container and have their own routable IP addresses. Kubernetes simplifies services connections by routing requests internally between hosts to the appropriate pod using iptables so that clients don’t have to track IP addresses. While this complexity brings efficiencies and ease of use, it can also be a challenge to monitor and secure network traffic, with potential risks such as:

• Compromise of a container, possibly running a malicious process or exploiting the file system
• Unauthorized connections between pods
• Data exfiltration from a pod
• Compromise of the worker node—the servers running application containers and other core infrastructure components

In 2018, the Tesla worker nodes were compromised by hackers, who created an external connection to control crypto mining software within one of Tesla’s Kubernetes pods and were able to leverage access credentials in Tesla’s AWS environment, opening the door to sensitive data. While the problem was quickly identified and rectified, it could—and should—have been stopped dead before it got that far.

RGS NeuVector: The Kubernetes Security & Protection Solution

NeuVector is a cloud-native, proactive platform that moves you from reactionary security to preventative zero-trust protection across the full lifecycle, including end-to-end vulnerability management, automated CI/CD pipeline security, runtime scanning, Contextual Zero-Trust Runtime. While orchestration and container management tools provide basic role-based access control (RBAC) and infrastructure security features, NeuVector addresses the three critical security vectors:

1. Application protection
2. Container inspection
3. Host security

NeuVector Protect First reduces the cost, impact, and reliance on post-event detection and patching that has become the norm. And it goes a step further, comprising the first Contextual Zero-Trust Runtime with automated enforcement in your live data stream, which blocks any malicious activity before it can harm your containers, critical applications, pods, nodes, or kernel. This is the industry’s only layer 7 container firewall, providing gated segmentation to protect more than 35 application protocols with built-in, push-button Security as Code deployment to automate and replicate security policy

With absolute knowledge and control of packet content, you can confidently protect containers against attacks from internal and external networks and eliminate the ability for an insider attack or newly introduced vulnerability to execute, leveraging:

• Deep Packet Inspection, the only real-time identification and blocking of network, packet, zero-day, and application attacks like DDoS, packet-level injection, or DNS tunneling attack attempts.
• Powerful forensics with Automated Packet Capture and Forensic Quarantine
• Native Container Data Loss Prevention (DLP) to protect sensitive data exposure in Kubernetes

Best Practices for Kubernetes Security

It’s imperative to protect your entire container pipeline, from Build to Ship to Run. Security posture tests designed for Kubernetes environments are available through the Center for Internet Security (CIS) Benchmarks for Kubernetes, which focus on:

• Build: Container code and image analysis
• Ship: Access controls and image signing
• Run: Host security and real-time monitoring

Given today’s rapid, automatic deployments and updates, it’s essential for your DevOps team to automate security and customize it to adapt and scale with your deployments using custom resource definitions (CRDs) to implement security as code. NeuVector sits next to your application containers in its own container, always prepared to block anonymous traffic before it can damage a pod, container or application.. This is protection beyond runtime scanning. The NeuVector platform also helps you achieve compliance with industry standards by providing and reporting on:

• Network segmentation and L7 firewalling
• Vulnerability scanning and remediation
• Configuration test auditing
• Restricted access controls
• Encryption and sensitive data protection
• Container DLP (Data Loss Prevention)
• Regulatory compliance frameworks like PCI, NIST, HIPAA, and STIG

With NeuVector, your organization can even exceed the SOC 2 standard required by all technology-based service organizations that store client data in the cloud.

About Rancher Government Solutions (RGS)

Rancher Government Solutions (RGS) is specifically designed to address the unique security and operational needs of the U.S. Government and military as it relates to application modernization, containers, and Kubernetes.

Rancher is a complete open-source software stack for teams adopting containers. It addresses the operational and security challenges of managing multiple Kubernetes clusters at scale, while providing DevOps teams with integrated tools for running containerized workloads.

More About Kubernetes

For a Kubernetes security checklist, download our white paper, The Ultimate Guide to Kubernetes Security: How to Secure Your Kubernetes Pipeline. You can also learn more about NeuVector and schedule a demo at Rancher Government Solutions.