Category Archives: Kubernetes

Critical Kubernetes privilege escalation flaw patched, update ASAP!

A critical privilege escalation vulnerability affecting the popular open source cluster management and container orchestration software Kubernetes has been patched on Monday. The project maintainers are urging users to update their installations as soon as possible, since the flaw can be easily exploited remotely by unauthenticated attackers to gain access to vulnerable Kubernetes clusters and the applications and data within them. About the vulnerability (CVE-2018-1002105) CVE-2018-1002105 affects the Kubernetes API server – more specifically, its … More

The post Critical Kubernetes privilege escalation flaw patched, update ASAP! appeared first on Help Net Security.

Critical Vulnerability Uncovered In Kubernetes

The first major security flaw has been uncovered in Kubernetes, the popular container orchestration system developed by Google. The vulnerability, identified as CVE-2018-1002105, carries a critical CVSS V3 rating of 9.8 due to low attack complexity, requiring no special privileges, and a network attack vector. The vulnerability is triggered when specially crafted requests allow users […]… Read More

The post Critical Vulnerability Uncovered In Kubernetes appeared first on The State of Security.

Securing Containers in The AWS Cloud with Trend Micro

Rapid adoption of containers is changing the way that businesses build their applications. Services like Amazon ECS, Amazon EKS, and AWS Fargate let builders focus on solving business problems instead of managing infrastructure.

But the move to containers also requires a shift in how you approach security.

Dynamic environments require security that integrates with CI/CD pipelines, provides runtime protection for Docker and Kubernetes, and protection for inter-container traffic.

Deep Security Smart Check is a scan service for your CI/CD pipeline, which scans Docker container images. These scans help detect vulnerabilities, malware, and exposed secrets. By integrating in to the CI/CD pipeline—and providing a full API—this helps cloud teams build security into their core process. This reduces friction and creates a strong system to help reduce issues.

Trend Micro is a support launch partner for the new AWS Container Marketplace offering Deep Security Smart Check at launch. Like the AWS Marketplace, the AWS Container Marketplace will make it easier for teams to quickly gain access to the solutions they need to improve their cloud workflows.

AWS Container Marketplace will support container products that run on any Docker-compatible runtime, including Amazon ECS (Fargate or EC2), and Amazon EKS.  Discover Trend Micro Deep Security Smart Check through AWS Marketplace or through the Amazon ECS Management Console.

Smart Check is provided as a helm chart, which you can deploy and launch using an orchestration service such as Amazon EKS.

That’s not the only container news. Additionally, Trend Micro is proud to announce its listing on the new  AWS Container Competency  program. AWS Competencies are granted to APN Partners who have demonstrated technical proficiency and proven customer success in specialized solution areas. Trend Micro provides a complete container protection solution backed by the world’s leading zero-day threat research teams to deliver you the best protection for your container workloads.

The AWS Competency is a nod to success seen by Trend Micro customers. Instead of hearing about it from us, why not directly from a customer? Here’s Jason Cradit—Senior Director of Technology at TRC—on how he and his team have transformed their AWS workloads by adopting a DevOps culture. Security has been a key part of that transformation and Jason’s team uses Trend Micro products to help make that happen.

https://youtu.be/8JYXl0H8k3M

TRC uses Deep Security to protect their containers because it allows them to use their preferred tools and deployment mechanisms. The API allowed the team to integrate security into their workflow, instead of having to change it.

In order to keep the advantages of containers, you need container-specific security solutions. The team at TRC had this to say about the Trend Micro solution, “Deep Security is the perfect solution for both Docker containers and AWS, providing the same high level of security we needed”.

Leveraging one tool across multiple environments and deployment methods lowers the cost and complexity of securing your workloads. Trend Micro has worked hard to make it as easy as possible to integrate security into your cloud workloads.

Together Deep Security and Deep Security Smart Check make it easier to maximize the operational effectiveness of your teams without sacrificing security. From the extensive APIs, purchase options aligned to the way you want to buy, automated deployment, and world-class security, these solutions let you focus on what really matters…meeting your business goals.

Want to try Deep Security? It’s only a few clicks away, same with Deep Security Smart Check. Lean more about the new AWS Container Competency or Trend Micro’s approach to AWS security.

The post Securing Containers in The AWS Cloud with Trend Micro appeared first on .

Container strategies don’t take security seriously enough

Most organizations do not feel prepared to adequately secure cloud-native applications, despite the surging adoption of containers and Kubernetes, according to StackRox. Notable findings: More than a third of organizations with concerns about their container strategy worry that their strategies don’t adequately address container security An additional 15 percent believe their strategies don’t take seriously enough the threat to containers and Kubernetes deployments More than one-third of respondents haven’t started or are just creating their … More

The post Container strategies don’t take security seriously enough appeared first on Help Net Security.