DevOps security improvements through effective use of container technology

The move toward cloud-native deployments will diminish the use of traditional server-based, hypervisor-driven virtualisation that delivers virtual machines (VM). As a result, the adoption of application-centric, container-based virtualisation will escalate. Containers and VMs are similar in their goals: to isolate an application and its dependencies into a self-contained unit that can run anywhere.1 Since cloud deployments are heavily geared towards agility, optimisation and automation, container-based technologies are riding the wave of rapid adoption, particularly in DevOps-oriented environments. Containers provide great flexibility for DevOps teams to tool up for frictionless service delivery life cycles. This presents an almost unprecedented opportunity to embed security into the software delivery pipeline, rather than graft on security checks, container monitoring and policy for access controls as an afterthought.2 Containers are not without problems, however. From a security perspective, if left unchecked, the technology is susceptible to many issues including supply chain risks and many forms of vulnerabilities originating from poor configuration and operational management. This could result in production environment compromise through targeted cyberattacks. This paper addresses the key activities to achieve hygiene in high-velocity, security-focused DevOps deployments.