Container security best practices: Ultimate guide
1–10 of 65 posts
Re: Container security best practices: Ultimate guide
#2Perhaps I overlooked it, but it seems strange there's nothing about making containers immutable and read-only. This is a powerful tool IMO.
https://cloud.google.com/architecture/best-practices-for-ope...
Re: Container security best practices: Ultimate guide
#3Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices.
If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices.
[1] https://www.cisecurity.org/
[2] https://public.cyber.mil/stigs/downloads/
[3] https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR...
[4] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Re: Container security best practices: Ultimate guide
#4Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices. If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices. [1] https://…
(disclaimer: I know the company and some of the early founders)
I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.
Re: Container security best practices: Ultimate guide
#5Curious to know whether anyone here can speak to how much safer Hyper V isolation[1] is than process isolation and whether it negates some of the concerns in the article.
1. https://docs.microsoft.com/en-us/virtualization/windowsconta...
Re: Container security best practices: Ultimate guide
#6Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices. If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices. [1] https://…
(disclaimer: I know the company and some of the early founders) I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.
It's supposed to be an "Ultimate guide" though.
Re: Container security best practices: Ultimate guide
#7Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices. If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices. [1] https://…
(disclaimer: I know the company and some of the early founders) I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.
Clearly sounds like a marketing document. Cites a survey from "Cloud Native Computing Foundation" and claims "92 percent of companies are using containers in production" + "Thus, Kubernetes, Openshift, and other container technologies are present everywhere" while ignoring the fact that the survey is heavily biased towards companies that run containers, of course.
Their own services and blog posts is also referenced in almost every section of the post, even when better external resources exists. Zero competitors are listed in any section. Doesn't sound very neutral to me.
Re: Container security best practices: Ultimate guide
#8Perhaps I overlooked it, but it seems strange there's nothing about making containers immutable and read-only. This is a powerful tool IMO. https://cloud.google.com/architecture/best-practices-for-ope...
It seems that Sysdig doesn't have a blog post about making containers immutable and read-only, nor offer a service that enables that, so probably not worth mentioning for them.
Re: Container security best practices: Ultimate guide
#9Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices. If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices. [1] https://…
(disclaimer: I know the company and some of the early founders) I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.
>but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper
Perhaps "Ultimate guide" is a bit of a misnomer.
Re: Container security best practices: Ultimate guide
#10Perhaps I overlooked it, but it seems strange there's nothing about making containers immutable and read-only. This is a powerful tool IMO. https://cloud.google.com/architecture/best-practices-for-ope...
I would assume that's because that mitigation isn't what sysdig does.