Compliance and Security Frameworks (10%)

Compliance Frameworks

• Examples: GDPR, HIPAA, NIST, PCI DSS, CIS

GDPR

• Introduced by the European Union to protect the data of citizens

HIPAA

• A United States regulation used to control the access to health data

PCI DSS

• Used to protect payment data

NIST

• Created by the United States but recognized globally.
• Used to protect compute environments by doing regular security-related audits (pentests, etc.)

CIS

• CIS creates benchmarks for various environments such as operating systems and Kubernetes

Threat-Modeling Frameworks

• Threat-modeling frameworks defined how to achieve the compliance frameworks mentioned above
• Two thread-models of interests are STRIDE and MITRE

STRIDE

• Created and maintained by Microsoft
• Helps identity 6 categories of threats
  • Spoofing
  • Tampering
  • Repudiation
  • Information Disclosure
  • Denial of Service
  • Elevation of Privilege

MITRE

• 5 categories
  • Initial Access
  • Execution
  • Persistence
  • Privilege Escalation
  • Defense Evasion
• https://microsoft.github.io/Threat-Matrix-for-Kubernetes/

Supply Chain Compliance

• Verify all the components (libraries, container images, etc.) that make up your application are secure and meet compliance requirements
• Securing the supply chain focuses on 4 main areas:
  • artifacts
  • metadata
  • attestations
  • policies

Reduce docker image size

• Smaller images are faster to download and deploy

• Smaller images are more secure

• Smaller images are easier to manage

• To reduce the size of a docker image:

  • Use a smaller base image
  • Use specific package/image versions
  • Make file-system read-only
  • Don’t run the container as root
  • Use multi-stage builds
  • Remove unnecessary files
  • Use a .dockerignore file to exclude files and directories from the image
  • Use COPY instead of ADD
  • Use alpine images
  • Use scratch images
  • Use distroless images

• Example of a multi-stage build:

  # build container stage 1
    FROM ubuntu
    ARG DEBIAN_FRONTEND=noninteractive
    RUN apt-get update && apt-get install -y golang-go
    COPY app.go .
    RUN CGO_ENABLED=0 go build app.go
  
  # app container stage 2
    FROM alpine:3.12.1 # it is better to use a defined tag, rather than 'latest'
    RUN addgroup -S appgroup && adduser -S appuser -G appgroup -h /home/appuser
    COPY --from=0 /app /home/appuser/app
    USER appuser # run as a non-root user
    CMD ["/home/appuser/app"]
  

• Dockerfile best practices: https://docs.docker.com/build/building/best-practices/

• Only certain docker directives create new layers in an image

  • FROM
  • COPY
  • CMD
  • RUN

• dive and docker-slim are two tools you can use to explore the individual layers that make up an image

Static Analysis

SBOM

• A SBOM is a list of all the software that makes up a container image (or an application, etc.)
• Formats
  • SPDX
    • The standard format for sharing SBOM
    • Available in JSON, RDF, and tag/value formats
    • More complex than CycloneDX due to it’s extensive metadata coverage
    • Comprehensive metadata including license information, origin, and file details
  • CycloneDX
    • A lightweight format focused on security and compliance
    • Available in JSON and XML formats
    • Simpler and more focused on essential SBOM elements
    • Focuses on component details, vulnerabilities, and dependencies

Kubesec

• Used for static analysis of manifests
• https://github.com/controlplaneio/kubesec

Syft

• Syft is a powerful and easy-to-use open-source tool for generating Software Bill of Materials (SBOMs) for container images and filesystems. It provides detailed visibility into the packages and dependencies in your software, helping you manage vulnerabilities, license compliance, and software supply chain security.
• Syft can export results in SPDX, CycloneDX, JSON, etc.
• To scan an image with syft and export the results to a file in SPDX format:

  syft scan docker.io/kodekloud/webapp-color:latest -o spdx --file /root/webapp-spdx.sbom
  

Grype

• Grype is a tool (also from Anchore) that can be used to scan SBOM for vulnerabilities
• To scan a SBOM with Grype:

  grype /root/webapp-sbom.json -o json --file /root/grype-report.json
  

Kube-linter

• Kube-linter can be used to lint Kubernetes manifests and ensure best practices are being followed
• kube-linter is configurable. You can disable/enable checks and even create your own custom checks
• kube-linter includes recommendations for how to fix failed checks
• https://github.com/stackrox/kube-linter

Scanning Images for Vulnerabilities

trivy

• trivy can be used to scan images for vulnerabilities
• https://github.com/aquasecurity/trivy
• Example:

    sudo docker run --rm  aquasec/trivy:0.17.2 nginx:1.16-alpine