Red Hat Kubernetes security report finds people are the problem
(2022/05/18)
- Reference: 1652857032
- News link: https://www.theregister.co.uk/2022/05/18/red_hat_kubernetes/
- Source link:
Kubernetes, despite being widely regarded as an important technology by IT leaders, continues to pose problems for those deploying it. And the problem, apparently, is us.
The open source container orchestration software, being used or evaluated by 96 per cent of organizations [1]surveyed [PDF] last year by the Cloud Native Computing Foundation, has a reputation for complexity.
Witness the sarcasm: "Kubernetes is so easy to use that a company devoted solely to troubleshooting issues with it has raised $67 million," [2]quipped Corey Quinn, chief cloud economist at IT consultancy The Duckbill Group, in a Twitter post on Monday referencing investment in a startup called Komodor. And the consequences of the software's complication can be seen in the difficulties reported by those using it.
[3]
According to Red Hat's [4]State of Kubernetes security for 2022 report [PDF], the majority of 300 DevOps, engineering, and security professionals survey respondents (55 per cent) said they had to delay the debut of an application in the past 12 months because of security concerns.
[5]
[6]
Fully 93 per cent of respondents reported at least one security incident in their Kubernetes environment in the past 12 months, with 31 per cent saying this led to revenue or customer loss. The report from IBM's Red Hat lays the blame on Kubernetes' focus on productivity rather than security.
"Kubernetes and containers, while powerful, were designed for developer productivity, not necessarily security," the report says. "Default pod-to-pod network settings, as an example, allow open communication to quickly get a cluster up and running, at the expense of security hardening."
The Layer Eight problem
Such complexity contributes to human error and leads to a lot of fumbled implementations of the software, to some degree.
Red Hat's report says "human error was a major contributing factor in 95 per cent of breaches," citing a World Economic Forum [7]report [PDF] that says "95 per cent of cybersecurity issues can be traced to human error." That report in turn points to a World Economic [8]post that says "studies show that 95 per cent of cybersecurity issues can be traced to human error" – without citing any specific studies.
[9]
Whatever the relevant figure, people are involved somewhere along the line and they don't handle complexity all that well. So, says [10]Ajmal Kohgadai , Red Hat product marketing manager, Kubernetes users tend to be more worried about typos than hackers.
"Despite extensive media attention over cyberattacks, the report highlights that it's actually misconfigurations that keep IT professionals up at night," he said in a [11]blog post . "Kubernetes is highly customizable, with various configuration options that can affect an application’s security posture. Consequently, respondents worry the most about exposures due to misconfigurations in their container and Kubernetes environments (46 per cent) – nearly three times the level of concern over attacks (16 per cent)."
[12]Red Hat makes OpenShift a key part of its edge initiative
[13]Dockershim deprecated with release of Kubernetes 1.24
[14]Containers may be more effective than VMs for hybrid apps – Gartner
[15]Open-source leaders' reputations as jerks is undeserved
Red Hat's answer to this is to automate configuration management as much as possible to reduce the impact of human error.
Toward this end, Red Hat has taken its Advanced Cluster Security (ACS) for Kubernetes, acquired last year via its purchase of StackRox, and [16]released the software as open source under the name of the company that made it.
"The StackRox project aims to help simplify DevSecOps by integrating security capabilities within the development and deployment lifecycle, effectively shifting application security "to the left" in software creation," said Red Hat in its [17]announcement .
[18]
The software analyzes container environments for risks, presents alerts, and offers security improvement recommendations.
But before companies can automate Kubernetes, they need people who know what they're doing to write the scripts and configuration files. And finding folks to do that turns out to be the top Kubernetes pain point, cited by 30 per cent survey respondents: "We lack internal talent to use it to its full potential." ®
Get our [19]Tech Resources
[1] https://www.cncf.io/wp-content/uploads/2022/02/CNCF-AR_FINAL-edits-15.2.21.pdf
[2] https://twitter.com/QuinnyPig/status/1525993144461889536?s=20
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.redhat.com/rhdc/managed-files/cl-state-of-kubernetes-security-report-2022-ebook-f31209-202205-en.pdf
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2022.pdf
[8] https://www.weforum.org/agenda/2020/12/cyber-risk-cyber-security-education
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.redhat.com/en/authors/ajmal-kohgadai
[11] https://www.redhat.com/en/blog/state-kubernetes-security-2022-1
[12] https://www.theregister.com/2022/05/11/red_hat_openshift_edge/
[13] https://www.theregister.com/2022/05/04/kubernetes_docker_cncf/
[14] https://www.theregister.com/2022/03/22/containers_vs_vms_vs_serverless/
[15] https://www.theregister.com/2022/05/12/not_all_opensource_leaders_are/
[16] https://github.com/stackrox/stackrox
[17] https://www.redhat.com/en/blog/red-hat-releases-open-source-stackrox-community
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://whitepapers.theregister.com/
The open source container orchestration software, being used or evaluated by 96 per cent of organizations [1]surveyed [PDF] last year by the Cloud Native Computing Foundation, has a reputation for complexity.
Witness the sarcasm: "Kubernetes is so easy to use that a company devoted solely to troubleshooting issues with it has raised $67 million," [2]quipped Corey Quinn, chief cloud economist at IT consultancy The Duckbill Group, in a Twitter post on Monday referencing investment in a startup called Komodor. And the consequences of the software's complication can be seen in the difficulties reported by those using it.
[3]
According to Red Hat's [4]State of Kubernetes security for 2022 report [PDF], the majority of 300 DevOps, engineering, and security professionals survey respondents (55 per cent) said they had to delay the debut of an application in the past 12 months because of security concerns.
[5]
[6]
Fully 93 per cent of respondents reported at least one security incident in their Kubernetes environment in the past 12 months, with 31 per cent saying this led to revenue or customer loss. The report from IBM's Red Hat lays the blame on Kubernetes' focus on productivity rather than security.
"Kubernetes and containers, while powerful, were designed for developer productivity, not necessarily security," the report says. "Default pod-to-pod network settings, as an example, allow open communication to quickly get a cluster up and running, at the expense of security hardening."
The Layer Eight problem
Such complexity contributes to human error and leads to a lot of fumbled implementations of the software, to some degree.
Red Hat's report says "human error was a major contributing factor in 95 per cent of breaches," citing a World Economic Forum [7]report [PDF] that says "95 per cent of cybersecurity issues can be traced to human error." That report in turn points to a World Economic [8]post that says "studies show that 95 per cent of cybersecurity issues can be traced to human error" – without citing any specific studies.
[9]
Whatever the relevant figure, people are involved somewhere along the line and they don't handle complexity all that well. So, says [10]Ajmal Kohgadai , Red Hat product marketing manager, Kubernetes users tend to be more worried about typos than hackers.
"Despite extensive media attention over cyberattacks, the report highlights that it's actually misconfigurations that keep IT professionals up at night," he said in a [11]blog post . "Kubernetes is highly customizable, with various configuration options that can affect an application’s security posture. Consequently, respondents worry the most about exposures due to misconfigurations in their container and Kubernetes environments (46 per cent) – nearly three times the level of concern over attacks (16 per cent)."
[12]Red Hat makes OpenShift a key part of its edge initiative
[13]Dockershim deprecated with release of Kubernetes 1.24
[14]Containers may be more effective than VMs for hybrid apps – Gartner
[15]Open-source leaders' reputations as jerks is undeserved
Red Hat's answer to this is to automate configuration management as much as possible to reduce the impact of human error.
Toward this end, Red Hat has taken its Advanced Cluster Security (ACS) for Kubernetes, acquired last year via its purchase of StackRox, and [16]released the software as open source under the name of the company that made it.
"The StackRox project aims to help simplify DevSecOps by integrating security capabilities within the development and deployment lifecycle, effectively shifting application security "to the left" in software creation," said Red Hat in its [17]announcement .
[18]
The software analyzes container environments for risks, presents alerts, and offers security improvement recommendations.
But before companies can automate Kubernetes, they need people who know what they're doing to write the scripts and configuration files. And finding folks to do that turns out to be the top Kubernetes pain point, cited by 30 per cent survey respondents: "We lack internal talent to use it to its full potential." ®
Get our [19]Tech Resources
[1] https://www.cncf.io/wp-content/uploads/2022/02/CNCF-AR_FINAL-edits-15.2.21.pdf
[2] https://twitter.com/QuinnyPig/status/1525993144461889536?s=20
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.redhat.com/rhdc/managed-files/cl-state-of-kubernetes-security-report-2022-ebook-f31209-202205-en.pdf
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2022.pdf
[8] https://www.weforum.org/agenda/2020/12/cyber-risk-cyber-security-education
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.redhat.com/en/authors/ajmal-kohgadai
[11] https://www.redhat.com/en/blog/state-kubernetes-security-2022-1
[12] https://www.theregister.com/2022/05/11/red_hat_openshift_edge/
[13] https://www.theregister.com/2022/05/04/kubernetes_docker_cncf/
[14] https://www.theregister.com/2022/03/22/containers_vs_vms_vs_serverless/
[15] https://www.theregister.com/2022/05/12/not_all_opensource_leaders_are/
[16] https://github.com/stackrox/stackrox
[17] https://www.redhat.com/en/blog/red-hat-releases-open-source-stackrox-community
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YoTDxtyC96ZZfp-OY6AOigAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://whitepapers.theregister.com/
Potemkine!
95 per cent of cybersecurity issues can be traced to human error
No kidding. And the other 5% are traced to E.T. ? Or cats maybe (you are never too careful when dealing with cats) ?
I would love to be paid a lot of €/$/£ to generate such tasteless and empty reports. Where can I apply?
werdsmith
I’ve lived this. Not just security but general service has been quite a shit-show because Kubernetes has been adopted when people (bosses) were dazzled by the idea of it. But the centre of excellence delivery department didn’t put it in right, nor did they train the support properly because they didn’t actually understand it themselves.
What's so special about K8s?
DevOpsTimothyC
In other news water wet, space empty etc. This sort of report is a waste of money.
Why do they think that K8s would be any different than the rest of IT. The elephant in the room is that C-Levels do not want to pay for security. They aren't willing to have it in the SDLC, and in most places I've seen the closest to network security has been a traditional firewall or WAF and a regular patch schedule.
We lack internal talent to use it to its full potential
Warm Braw
Just about every job advertisement I see presently for anything even vaguely related to development is demanding knowledge of "Docker/Kubernetes". Conflating the two is perhaps still excusable, but I'm not sure it's a great idea to expect your developers also to cover deployment as a side hustle.
It is complex (perhaps unnecessarily so) and it needs not only knowledge and experience but also time to do it right. There does seem to be an unjustified expectation that if you adopt DevOps then the ops simply disappears.
It's still Kubernetes fault
> Kubernetes is highly customizable, with various configuration options that can affect an application’s security posture.
If the vast majority of security issues are attributed to misconfigurations, and misconfiguration is what keeps most operators up at night, then the problem isn't the users it's the application.
It's possible (but hard) to be highly customisable *and* safe. Kubernetes (apparently) hasn't achieved that equilibrium.