Securing the infrastructure and the workloads of linux containers

2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015

Volumn , Issue , 2015, Pages 559-567

  Mattetti, Massimiliano ^a   Shulman Peleg, Alexandra ^b   Allouche, Yair ^b   Corradi, Antonio ^a   Dolev, Shlomi ^c   Foschini, Luca ^a  

^a UNIVERSITY OF BOLOGNA   (Italy)

^b IBM   (Israel)

^c BEN GURION UNIVERSITY OF THE NEGEV   (Israel)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER OPERATING SYSTEMS; CONTAINERS; INTRUSION DETECTION; LINUX;

AUTOMATIC CONSTRUCTION; CONTAINER MANAGEMENT; NOISY ENVIRONMENT; OPTIMIZED PERFORMANCE; PRODUCTION ENVIRONMENTS; PROTECTION MECHANISMS; SECURITY HARDENING; TESTING ENVIRONMENT;

NETWORK SECURITY;

EID: 84966293811     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CNS.2015.7346869     Document Type: Conference Paper

References (37)

1. Cloud security: Virtualization, containers, and related issues. http://www. dwheeler. com/essays/cloud-security-virtualization-containers. html.
2. Containers and docker: How secure are they? https://blog. docker. com/ 2013/08/containers-docker-how-secure-are-they.
3. Docker hub official repositories. https://registry. hub. docker. com/.
4. For containers, security is problem #1. http://www. networkworld. com/ article/2921006/network-storage/for-containers-security-is-problem-1. html.
5. Grsecurity. https://grsecurity. net.
6. Integrity measurement architecture (ima). http://researcher. watson. ibm. com/researcher/view group. php?id=2851.
7. Ossec. http://www. ossec. net/.
8. Selinux. http://selinuxproject. org/page/Mainn Page.
9. Smack. http://en. wikipedia. org/wiki/Smack.
10. Tomoyo. http://tomoyo. osdn. jp/.
11. Cloud foundry foundation, 2014. http://cloudfoundry. org/ cloud-foundry-foundation-launch. html.
12. Docker : Vulnerability statistics, 2014. http://www. cvedetails. com/ product/28125/Docker-Docker. html?vendor id=13534.
13. Docker image insecurity, 2014. https://titanous. com/posts/ docker-insecurity.
14. Linux kernel : Vulnerability statistics, 2014. http://www. cvedetails. com/ product/47/Linux-Linux-Kernel. html?vendor id=33.
15. Shocker-docker breakout poc, 2014. https://github. com/gabrtv/shocker.
16. Apparmor, 2015. http://wiki. Apparmor. net/index. php/Main Page.
17. Application security on cloud, 2015. http://www. ibm. com/marketplace/ cloud/application-security-on-cloud/us/en-us.
18. Docker, inc., 2015. www. docker. com.
19. A. Buecker, K. Browne, L. Foss, J. Jacobs, V. Jeremic, C. Lorenz, C. Stabler, J. Van Herzele, and I. Redbooks. IBM Security Solutions Architecture for Network, Server and Endpoint. IBM redbooks. IBM Redbooks, 2011.
20. T. Bui. Analysis of docker security. ArXiv preprint arXiv:1501. 02967, 2015.
21. S. N. Chari and P.-C. Cheng. Bluebox: A policy-driven, host-based intrusion detection system. ACM Transactions on Information and System Security (TISSEC), 6(2):173-200, 2003.
22. CSA. Cloud computing vulnerability incidents: A statistical overview, 2013.
23. F. C. Eigler and R. Hat. Problem solving with systemtap. In Proc. of the Ottawa Linux Symposium, pages 261-268. Citeseer, 2006.
24. W. Felter, A. Ferreira, R. Rajamony, and J. Rubio. An updated performance comparison of virtual machines and linux containers. Technology, 28:32, 2014.
25. S. Forrest, S. Hofmeyr, and A. Somayaji. The evolution of systemcall monitoring. In Computer Security Applications Conference, 2008. ACSAC 2008. Annual, pages 418-430. IEEE, 2008.
26. M. Goncharov. Russian underground 101. Trend Micro incorporated research paper, 2012.
27. A. Kovalev, K. Otrashkevich, E. Sidorov, and A. Rassokhin. Effusion- A new sophisticated injector for nginx web servers. 2014.
28. A. Kurmus, A. Sorniotti, and R. Kapitza. Attack surface reduction for commodity os kernels: Trimmed garden plants may attract less bugs. In Proceedings of the Fourth European Workshop on System Security, page 6. ACM, 2011.
29. D. Merkel. Docker: lightweight linux containers for consistent development and deployment. Linux Journal, 239(2), 2014.
30. N. Provos. Improving host security with system call policies. In USENIX Security, volume 3, 2003.
31. M. Sacks. Production launches. In Pro Website Development and Operations, pages 73-92. Springer, 2012.
32. I. S. Systems. IBM x-force threat intelligence quarterly, 1q 2015, 2015. http://publiC. Dhe. ibm. com/common/ssi/ecm/wg/en/wgl03073usen/ WGL03073USEN. PDF.
33. K. M. Tan, K. S. Killourhy, and R. A. Maxion. Undermining an anomalybased intrusion detection system using common exploits. In Recent Advances in Intrusion Detection, pages 54-73. Springer, 2002.
34. J. Turnbull. The Docker Book: Containerization is the new virtualization. James Turnbull, 2014.
35. D. Wagner and P. Soto. Mimicry attacks on host-based intrusion detection systems. In Proceedings of the 9th ACM Conference on Computer and Communications Security, pages 255-264. ACM, 2002.
36. S. Whalen. An introduction to arp spoofing. Node99 [Online Document], April, 2001.
37. C. Wright, C. Cowan, S. Smalley, J. Morris, and G. Kroah-Hartman. Linux security modules: General security support for the linux kernel. In Foundations of Intrusion Tolerant Systems, pages 213-213. IEEE Computer Society, 2003.