Container Security, 2nd Edition

Chapter 16. Containers and the OWASP Top 10

If you’re in the security field, there’s a good chance you have come across OWASP, the Open Web Application Security Project; perhaps you’re even a member of a local chapter. This organization periodically publishes a list of the top 10 web application security risks.

While not all applications, containerized or otherwise, are web applications, this is a great resource for considering which attacks to be most concerned about. You’ll also find great explanations of these attacks and advice on how to prevent them on the OWASP website. In this chapter, I’ll relate the current top 10 risks¹ to container-specific security approaches.

Broken Access Control

This category relates to the abuse of privileges that may be granted unnecessarily to users or components. There are some container-specific approaches to applying least privilege to containers, as discussed in Chapter 11:

• Don’t run containers as root.

• Limit the capabilities granted to each container.

• In Kubernetes, use RBAC to limit permissions.

• Use rootless containers, if possible.

You can also use runtime security tools, as discussed in Chapter 15, to limit the actions that can be taken by a container.

These approaches can limit the blast radius of an attack, but none of these controls relates to user privileges at the application level, so you should still apply all the same advice as you would in a traditional deployment.

Cryptographic Failures

It is particularly important to protect ...