Locking down containers

Containerization can be a great way to control information sharing, but securing containers has a way to go toward maturity, said Kerry Long, a program manager at the Intelligence Advanced Research Projects Activity.

Containers virtualize a single application and package it with just the software, libraries and operating system features it needs to run, eliminating some of the dependencies that slow down deployments. They offer all the benefits of virtualization, but with better use of hardware and an already-broad ecosystem of applications, according to an article by Red Hat’s Dave Egts.

When containerization first emerged, its intent was to ease the distribution and delivery of software, Long said, but little thought was given to security. IARPA’s Virtuous User Environment program, which Long runs, aims to define and develop more secure containerized user environments that can operate in commercial clouds such as Google’s and Amazon’s.

Containers’ convenience is driving their success, he said. They remove what he called “dependency hell,” which can happen when a new application needs something else installed first in order to make it work. With containers, application developers provide a total package that will run on a workstation or server with all of the dependencies built into the container.

Although it’s extra work to provide additional code, “it’s made life a lot easier for developers at the end of the day because they don’t have to worry about supporting your individual workstation,” Long said.

“Containers are an interesting way -- if you could do it -- of creating an isolated workload that you could put on a cloud,” Long said. "And the theory is if you built the container correctly, it might be able to defend itself well and protect itself both from outside attackers and attackers beneath, which is the underlying infrastructure that you’re running on."

But a major problem with containers is there’s no way to know whether that dependency code is safe to run.

“The big problem … is what software are you really running on your server, on your workstation? Is it patched? Is it up-to-date? The answer is almost certainly not,” Long said.

Another issue is the sheer number of containers that are available. Adoption of Docker containers -- which wrap software in a complete filesystem -- increased by about 30 percent in one year, according to research by Datadog, while another survey found adoption doubled.

“You can just download a container and it works and you’re happy, but you don’t know who provided that container, and you don’t know what’s running inside of it,” Long said. “Bad people can make containers that run really well. For all you know, it’s collecting information and sending it back, but it’s still doing the job you wanted it to do.”

To address this security issue, software firms Cloudera and Docker have partnered on a solution that lets government agencies share data via cryptographically secure containers based on Cloudera’s Navigator Encrypt running on Docker’s Commercially Supported Engines. Docker provides an abstraction layer for Navigator Encrypt, which encodes and secures data at rest, and Cloudera’s Navigator Key Trustee Server handles key management.

Government agencies “have a need to collaborate, and a cloud environment certainly enables that, but there are some gaps in cloud, including things like key management,” Cloudera’s public-sector CTO Rob Morrow said. “If your cloud provider already owns the root on all of your boxes -- and they do -- then they can’t also be the person that encrypts the data. In other words, you have to protect yourself from both the cloud provider as well as the collaborating partner.”

This solution could be used for data sharing between the human resources and payroll departments, for example. HR may want to share Social Security numbers with payroll but not health care or compensation plan data. Containers could allow for that kind of access control.

Long envisioned a department of motor vehicles using it to limit what information is shared from its database. It could provide the answers “without giving you all the info,” he said.

Another of the solution’s security perks is remote self-destruct, Morrow said. When users’ rights to a workload are terminated, “it’s very trivial to revoke the key that allows them to decrypt the container that would be running that workload and therefore completely terminate access,” he said. Plus, managers don’t need access to the container to revoke its key.

The joint solution can be installed on either bare metal or cloud environments -- specifically, parts of Amazon Web Services GovCloud and all of C2S. Additionally, Cloudera’s products already comply with Federal Information Processing Standard 140-2.

For IARPA’s purposes, Long sees potential in containers. He likes the control that the isolated environment brings. “They’re not going anywhere, and they’re going to make things much more efficient, in theory,” he said.