Red Hat release The latest "Kubernetes Security in 2022" report investigates the security challenges organizations face in cloud native development, and how they respond to these challenges to protect their applications and IT environment. Based on a survey of more than 300 DevOps, engineering and security professionals, the report focuses on how the company balances the security of these environments while adopting containers and Kubernetes.
The report points out that, similar to previous years, safety is still one of the biggest problems in container adoption. The integration of new technologies with traditional IT environments may bring unexpected security challenges. As the security requirements of containers span all aspects of the application life cycle, from development to deployment and maintenance, containers are particularly complex. The report found that the most common concern of 31% of respondents about container strategies was the threat to container security and insufficient investment in container security.
93% of the respondents have experienced at least one security incident in their Kubernetes environment in the past 12 months, which sometimes led to the loss of income or customers. Over the past year, more than half of the respondents (55%) had to postpone the launch of their applications due to security issues. In this regard, The report blames Kubernetes for its focus on productivity rather than security. "Although Kubernetes and containers are powerful, they are designed for the productivity of developers, not necessarily for security. For example, the default pod to pod network setting allows open communication to quickly start and run a cluster, but it sacrifices security reinforcement."
According to the report, human error is still one of the reasons for data leakage; It refers to World Economic Forum A research report It is proved that "human error is the main contributing factor of 95% of data leakage events". Data shows that in the past 12 months, nearly 53% of respondents have experienced misconfiguration events in their environment. 38% found a major vulnerability, and 30% said they had encountered a run-time security incident; Another 22% said they failed the audit.
Compared with the network attack widely concerned by the media, IT personnel are most worried about the risk caused by misconfiguration. "Kubernetes is highly customizable, with various configuration options that can affect the security status of the application. Therefore, respondents are most worried about the risk (46%) caused by the misconfiguration in the container and Kubernetes environment - almost three times more worried about attacks (16%).". Automating configuration management as much as possible will help alleviate these problems.
On the other hand, DevSecOps has gradually become the standard of some organizations. The vast majority of respondents (78%) said that they had DevSecOps plans at the primary or advanced stages. In terms of DevSecOps, 27% of respondents believe that they are the most forward-looking organization. They adopt the advanced DevSecOps plan to integrate and automate security throughout the application life cycle.
The cooperation among development, operation and maintenance and security teams is also valued. The report points out that due to today's rapid release cycle, security has to be moved to the left and embedded in DevOps workflow, rather than considered when the application is about to be deployed to production; Most respondents agreed with this view. In addition to many people who are implementing DevSecOps, only 22% of respondents said they continue to operate DevOps separately from security; And only 16% of respondents confirmed that they would be responsible for Kubernetes' security by the central IT security team.
Red Hat concluded that despite the potential security problems, the advantages of using containers and Kubernetes still outweigh the disadvantages. The key is to find a container and Kubernetes security platform, and take DevOps best practices and internal control as part of its configuration check. It should also assess the security of Kubernetes' own configuration so that developers can focus on function delivery.
Full Report Address
