The Importance of Container Compliance
With containers running so many critical applications today, compliance is often table stakes for doing business. However, meeting the prerequisites to conduct business in certain industries and regions is only one of the reasons container compliance is important.
Container compliance also helps enterprises:
- Avoid fines, penalties, and lost revenue: In many cases, non-compliance means fines and penalties that directly impact the bottom line. Additionally, if non-compliance leads to action that prevents enterprises from doing business with a specific customer or region, it can lead to lost revenue.
- Improve overall security posture and reduce risk: Often, compliance requirements overlap with overall security best practices. As a result, implementing the policies and procedures required to remain compliant may improve overall security posture, including container security, and reduce the risk of a security incident.
- Protect their reputation: A security breach is generally bad for an enterprise’s reputation. However, even if a breach occurs, an enterprise that can demonstrate they followed cybersecurity best practices and were compliant with the relevant security standards will be able to protect their reputation better than a non-compliant organization.
Container Compliance Challenges
Often, with compliance comes complexity. This is particularly true with container compliance because many standards were written before containerized workloads surged in popularity, or simply don’t clearly speak to container use cases.
Some of the most frequent challenges involved in achieving compliance for containers include:
- Container visibility: To achieve compliance, enterprises need visibility across all their workloads, but understanding what container workloads are running, where they’re running, and how they’re configured is difficult at scale. Workloads are spread out across public and private clouds, images may come from multiple sources, and configurations can vary.
- Managing configuration drift: Once compliant configurations and policies are implemented, enterprises may be compliant at a given point in time. However, maintaining a compliant state can be challenging in the face of configuration drift. Detecting and remediating misconfigurations and policy violations quickly and reliably is a key aspect of remaining complaint.
- Implementing granular access controls: Many standards require enterprises to implement granular access controls to prevent unauthorized access to sensitive data. For example, PCI DSS requires enterprises to restrict access to cardholder data in a manner that is comparable to the principle of least privilege.
- Managing vulnerabilities in external libraries and images: Container images pulled from untrusted container repositories or third party libraries and dependencies can introduce a variety of security issues into containerized environments. Enterprises need a plan to mitigate this risk to remain compliant.
- Maintaining compliance in multi-cloud environments: Containerized workloads are often spread across multiple platforms in multi-cloud environments. In those cases, enterprises need to ensure container compliance acros public cloud platforms and on-premise infrastructure.
Those high level challenges apply to multiple standards. In the sections below, we’ll look at specific standards and how they relate to container security compliance.
NIST Compliance for Containers
The United States National Institute of Standards and Technology (NIST) has developed a number of standards and best practice guidelines, many of which relate directly to cybersecurity and data compliance. In many cases, complying with specific NIST standards is a prerequisite for doing business with the United States government.
Some of the most relevant NIST cybersecurity guidelines and standards enterprises should be familiar with are:
- NIST Cybersecurity Framework: A cybersecurity framework that provides guidance on a variety of cybersecurity standards, practices, and guidelines. It covers five key functions: identify, protect, detect, respond, and recover. In the United States, Executive Order 13800 made the NIST Cybersecurity Framework a requirement for federal agencies.
- Federal Information Processing Standards (FIPS): A set of cybersecurity standards for computer systems that belong to the United States Federal Government.
- NIST SP 800-37: Relates to the use of continuous monitoring for risk management.
- NIST SP 800-53: Details security controls for information systems belonging to the United States Federal Government.
- NIST SP 800-137: Deals with the use of automation for monitoring and reporting.
PCI DSS Compliance for Containers
The Payment Card Industry Data Security Standard (PCI DSS) defines a framework that enterprises that accept or process card payments must follow to reduce the risk of fraud and data compromise. This makes PCI DSS container compliance a must for many container workloads involved in eCommerce and retail.
Achieving PCI DSS compliance includes meeting twelve data security and operational requirements including not using default values for passwords and security parameters, maintaining a firewall, securely storing cardholder data, and regularly updating antivirus programs.
Because PCI DSS is not overly prescriptive in how enterprises must meet these requirements, getting it right for container workloads can be a challenge. Tools like Kubernetes Security Posture Management (KPSM) platforms can help enterprises achieve PCI DSS compliance by automating the process of defining security policies, scanning container workloads in K8s clusters, detecting misconfigurations, and identifying issues with role-based access controls (RBAC).
GDPR Compliance for Containers
GDPR applies to all organizations that handle the personal data of the European Union’s (EU’s) citizens. It includes requirements related to the encryption and pseudonymisation of EU citizen’s personal data, maintaining the confidentiality, integrity, and availability (CIA) of systems involved in processing data, regular testing, and restoration capabilities in the event of an accident.
To achieve GDPR compliance for containerized workloads, enterprises must take a multi-pronged approach to container security. For example, enterprises may scan images for vulnerabilities, enforce strict network access controls, limit access to sensitive data, and monitor for threats in real time as part of the steps required to comply with GDPR.
CIS Benchmarks for Containers
The Center for Internet Security (CIS) maintains a set of secure configuration best practices — known as CIS Benchmarks — for a variety of systems from multiple vendors. These best practices are based on consensus derived from cybersecurity experts around the globe.
CIS Benchmarks are widely recognized across the globe as an authoritative reference for secure practices and often overlap with other cybersecurity standards like ISO/IEC 27000-series standards, the NIST Cybersecurity Framework, and PCI DSS.
CIS publishes benchmarks for a variety of cloud and container-related platforms including Kubernetes and Docker. With tooling like enterprise-grade Cloud Security Posture Management (CSPM) organizations can streamline the process of evaluating their infrastructure against CIS standards and gain granular visbility into their containerized workloads.
Container Compliance with CloudGuard
Addressing container security compliance at scale takes the right combination of strategy, processes, and tools. The CheckPoint CloudGuard platform is a complete cloud security and compliance solution that is purpose-built to address a wide range of container compliance use cases.
With CloudGuard, enterprises can:
- Automate compliance and monitor policy changes in real time with the Automated Trusted Advisor.
- Create detailed reports on compliance status and view security levels in the context of regulations like PCI DSS and GDPR.
- Achieve deep visibility across all containers, even in multi-cloud environments.
- Enforce secure access control policies to help remain compliant using CloudGuard’s Admission Controller.
- Scan container images for insecure configurations, vulnerabilities, and malware.
To see the power of CloudGuard first-hand, sign up for a free container security demo today or start a free CloudGuard CSPM trial. Alternatively, if you’d like to take a deeper dive into container security challenges, download our free Container Security Guide.
Feedback