Securing Orchestrated Containers with BSI Module SYS.1.6

Christoph Haar, Erik Buchmann

2021

Abstract

Orchestrated container virtualization, such as Docker/Kubernetes, is an attractive option to transfer complex IT ecosystems into the cloud. However, this is associated with new challenges for IT security. A prominent option to secure IT infrastructures is to use security guidelines from agencies, such as Germany’s Federal Office for Information Security. In this work, we analyze the module ”SYS.1.6 Container” from this agency. We want to find out how suitable this module is to secure a typical Kubernetes scenario. Our scenario is a classical 3-tier architecture with front end, business logic and database-back end. We show that with orchestration, the protection needs for the entire Kubernetes cluster in terms of confidentiality, integrity and availability automatically become ”high” as soon as a sensitive data object is processed or stored in any container. Our analysis has shown that the SYS.1.6 module is generally suitable. However, we have identified three additional threats. Two of them could be exploited automatically, as soon as a respective vulnerability appears.

Paper Citation

in Harvard Style

Haar C. and Buchmann E. (2021). Securing Orchestrated Containers with BSI Module SYS.1.6.In Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-491-6, pages 676-683. DOI: 10.5220/0010340406760683

in Bibtex Style

@conference{icissp21,
author={Christoph Haar and Erik Buchmann},
title={Securing Orchestrated Containers with BSI Module SYS.1.6},
booktitle={Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2021},
pages={676-683},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010340406760683},
isbn={978-989-758-491-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Securing Orchestrated Containers with BSI Module SYS.1.6
SN - 978-989-758-491-6
AU - Haar C.
AU - Buchmann E.
PY - 2021
SP - 676
EP - 683
DO - 10.5220/0010340406760683