security · Page 3 of 9 · Bluwater Technologies

What You Need to Know About Containers Security

a large blue container sitting in front of many colorful containers

Containerization has revolutionized software deployment. It allows faster deployment cycles, easier scalability, and consistency across environments. It’s a standard part of the DevOps process. Containers provide clear benefits in security, but they offers their own challenges.

Making a containerized environment run smoothly and securely requires specialized expertise and experience. Bluwater provides the management and support to keep the software running and minimize the risks.

Understanding Containers

Software applications have many dependencies. They use runtime environments, subroutine libraries, and system services. They need to adapt to the operating system on which they run. The container puts all the dependencies into a single package that’s deployed as a unit. The software on which the application depends will always be the same.

For instance, suppose an application runs on a Java Virtual Machine (JVM). Containerization ensures that each instance runs on the same version of the JVM, no matter where it’s deployed. The developers and admins don’t have to worry about having to run under an outdated or unpatched JVM.

However, a container isn’t a monolith that does everything the application needs. More commonly, it’s split up into services, each of which has its own container. Services communicate through APIs.

You can deploy many container instances on one machine. These numbers can be scaled up or down to meet current needs. Each one runs independently of the others. However, a container isn’t the same as a virtual machine. All the containers on the host run under the same instance of the operating system. Containers aren’t as fully isolated from each other as VMs are.

Security Benefits and Concerns

Containerization isn’t a total solution to all security problems. It makes some issues easier to deal with but introduces its own concerns. The NIST Application Container Security Guide gives a detailed summary of the issues and best practices.

Benefits

The big advantage of containers, from a security standpoint, is control. A software release contains tested and trusted versions of all supporting libraries and runtimes. When you keep them up to date, they will be up to date wherever you install the release. You only need to ensure that the latest patches are included once.

When software has to run in a diverse environment, it’s harder to test all the cases. Bugs can slip through, opening the way to attacks. Containers offer a consistent environment that we can test more exhaustively. There’s less need to worry about special cases.

Concerns

The negative side is that containers offer a consistent, predictable target. If a container has a vulnerability, every deployed instance has it. This simplifies the job of anyone trying to attack it.

Containers aren’t as isolated from each other as VMs are. Depositing malware into one container could mean easy proliferation of all the others on the same host. They can re-infect each other unless we take down all compromised instances simultaneously.

How to Heep Containers Secure

With proper management, a containerized environment can maintain a high-security level. The old techniques don’t always work, though. The NIST guide recommends a set of practices for keeping risks low. Here are a few tips based on it.

Use an OS tailored for containerization. Containers contain everything they need, so they don’t require many standard operating system components and services. Using a distribution that trims them down to a minimum reduces the attack surface.
Use security tools that are designed for a container environment. Developers often do not design standard anti-malware tools to handle large numbers of identical processes that appear and disappear. Ensure that your security software has a rating for containerized deployments.
Group only related containers under the same host. Having just one application (including all its services) running on a host reduces the opportunities for cross-application attacks.
Use hardware-based security to isolate containers. The less visible containers are to each other, the harder it is for infections to spread.

Bluwater provides the most up-to-date security solutions, letting you focus confidently on your business needs. Consulting, threat detection, removal, vulnerability testing, and user security are just some of the ways we can help keep your systems safe. Each kind of environment poses its own challenges, and we have the experience and expertise to protect them all.

Forbes: Does Your MSP Have Your Back?

a man with a backpack and suitcase walking

While small businesses, like their larger counterparts, need end-to-end services to keep them running smoothly—file sharing, software, and security as a service to cloud backups—a less-experienced MSP may simply be riding the cloud surge to keep their doors open.

As the Forbes Technology Council notes:

“…so many MSPs are newbies and/or are opportunistically hanging out where the action appears to be. It appears that the accent today is more on “provider” and less on “service.” A fair number of MSPs have taken to selling the cloud — a “best of times” development at first blush.”

Sizing up your MSP…

Aside from basic services, does your MSP stand ready to do the real heavy lifting in times of Disaster Recovery, or handle hybrid installs with your latest SaaS applications?

SMB owners often place their networks ‘at risk’ on many fronts when timely security updates are shuffled to the bottom of their to-do lists. What’s more, just attempting to keep ahead of the latest IT developments can translate quickly to poor productivity in light of ever-changing market conditions.

Vetting your MSP…

Make sure you’ve made a list of questions to ask your potential candidate. including:

Do they offer more than off-the-shelf, basic services—can they tailor services to your specific needs?
How many years in the business?
Staffing: Level of engineering experience?
Is the service level agreement fit your needs? Penalties for not meeting requirements

Ask the tough questions….

A ‘biggie’ is making sure the MSP is SSAE (Standards for Attestation Engagements) compliant, offering 14-day retention, for example, with its managed backups, as well as “application-level protection, advanced monitoring, and multilevel intrusion prevention, SSL capability, hardware firewall, and IP-restricted FTP.”

BluWater Technology can offer your company levels of expertise tailored to your growing needs. Contact us to learn how our services can help your business run more efficiently: we improve bottom lines by bringing ‘fixed costs’ to your operation’s IT expenditures.

it support outsourcing security

Mobile Security Threatens Company Data

a pile of papers sitting on top of each other

According to CIO magazine, a Gartner analyst two years ago pointed to the “growing shortage of cybersecurity resources” and how those impending threats to company data continue to grow:

“Companies are worse off by 100% (with cybersecurity) compared to 10 years ago because the world is more complicated now…Companies have definitely raised the cybersecurity bar, but criminals can keep going higher than the bar.”

BYOD brings security risks to company data

Unfortunately, employees unwittingly connect to Wi-Fi hotspots that are traditionally not safe, from coffee shops and restaurants to airports and hotels. Instead, device users should connect through a virtual private network (VPN), one of the many services an experienced MSP can offer.

Gartner’s prediction provides that clarion calls for businesses with remote, cloud operations to address these ‘new’ security risks, particularly with the incorporation of mobile devices (BYOD) in the workplace.

“When employees connect to public WiFi without using a VPN app, they put their company’s data at risk,” notes the head of Avast Software’s mobile division.

Global survey: More than half of SMBs use in-office/remote employees

A global survey of IT pros found that “fifty-eight percent of SMBs now have a mix of in-office and remote employees.” What’s more, those employees are working 2 to 3 days a week from home.

Even more reason for SMBs to consider using a managed service provider ( MSP) for mobile-device management. MSPs utilize a set of protocols and platforms to mitigate risks associated with the proliferation of BYODs.

In addition, a seasoned pro, like BluWater, can manage a company’s firewall, antivirus, and application upgrades/updates—and even conduct a vulnerability assessment of a company’s, on-premise networks.

Contact us today. We can help you implement a BYOD strategy that fits your needs. Companies rely on us to provide them with the security and scalability to make them successful now and in the future.

data mobile security

Cisco: IT Decision Makers Challenged with Mobile Security and Compliance

a person holding up a piece of paper with a cloud cut out of it

The digital landscape is alive with change, particularly when it comes to the proliferation of mobile devices (BYOD) in the workplace. The dawning of this phenomenon began as far back as 2009, when the phrase first took hold, becoming, as CIO notes, the ‘New Normal’ in 2013:

“CIOs can thank mobile device management vendors for pushing their messages of compliance to business users and, as a result, helping bring IT into the discussion as a BYOD enabler.”

Cisco: More control of the cloud network is needed

In fact, a Cisco survey of 4,000 IT decision-makers worldwide noted the need for more control of the cloud network. Especially with the ever-increasing array of mobile devices, smartphones, and tablets in the workplace.

However, along with this general acceptance of BYOD in the workplace, 82 percent of those surveyed were concerned about compliance and security requirements.

Follow the ‘moving’ mobile device!

For example, aligning departmental needs with a company’s BYOD policies creates new challenges. If an employee who uses his/her own mobile device switches to a new device, how is sensitive info to be tracked and stored? Worse, what happens to that data if the person leaves the company?

Cisco notes savings with BYOD in the workplace

Are these concerns lessened when the economic metric is added in? According to a recent Forbes overview on BYOD devices, Cisco notes a typical savings of $350 annually…per employee.

Still, concerns persist about ‘security’ when it comes to mobile strategies. As Forbes notes:

“Security is one concern for there are undeniable risks in permitting employees’ access to corporate resources from personal devices. The dangers posed by malicious applications and viruses will discourage many organizations from implementing BYOD.”

Contact us to learn how our managed services can help protect your cloud network. We really focus on your business needs before recommending our managed service options—clients love our proactive approach.

cloud compliance mobile security

Auto Complete Passwords: Safe or Dangerous?

a close up of a wall with many different types of words

Auto-complete for passwords is a feature commonly used in browsers today. It is a mechanism that allows usernames and passwords to be automatically entered into a web form. Only around 20% of US internet users have unique passwords for each online account. Many people have to manage dozens of different passwords and see auto-fill as a convenient feature that cuts down on time. However. others use a dedicated application to manage passwords outside of the browser. However, this is much more dangerous than many realize.

A hacker can easily trick the browser or program by placing an invisible form on a compromised web page.

MARKETERS TRACK TOO

Surprisingly, this is not only done by hackers. Digital marketers often deploy this trick to track what websites users visit. AdThink and OnAudience are both known to do this. Their goal is gathering data for marketing purposes, but IT professionals warn it would not be hard for them to steal passwords as well.

ONE EASY AND EFFECTIVE WAY TO IMPROVE SECURITY

It is quite simple to disable auto-complete in a browser. Privacy settings in most browsers can be easily accessed and auto-complete disabled within a minute. Below are instructions to accomplish this.

For Chrome users: Go to the Settings window, go to Advanced, and then disable under Manage Passwords.

For Firefox users: Go to the Options window, click the Privacy tab, then under the History heading, select “Firefox will: Use custom settings for history.” Then in the new window, disable “Remember search and form history.”

For Safari users: Open the Preferences window, select the Auto-fill tab, and turn off all features related to usernames and passwords.

Unfortunately, this is just one way hackers can get your information. Thus, modern organizations with advanced technology require more managed measures against hackers.

passwords security