What are the best practices for anti-virus / anti-malware when using containers?

Question

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for this in the container world. I'm not sure if it's a good practice to run AV on the host OS? Some materials I found in my Googling seem to indicate that if you do something like that, you would need to exclude the files used by the container to avoid locking up the container. Which sounds like it would defeat the purpose.

In our particular case, we're running on GKE using Google's pre-made container OS. Anyone have experience with this?

Answer 1

This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that adequate controls are applied, not specifically that "Production Servers have Endpoint Protection"; Anti-virus and Anti-malware are among some of the most basic controls applied to technology.

As a bit of a starter for ten, you could consider the following:

• Secure Software Development Lifecycle (S-SDLC): In traditional environments, developer and administrator workstations would have Anti-virus and Anti-malware products installed, therefore any code that a developer creates and an administrator deploys will have been subject to routine automatic scans. It's easy to forget that the same controls need to be applied to our automated pipelines, one option would be to scan both source code and artefacts with ClamAV or a commercial antivirus product.
  • Trivy - not anti-virus but does offer vulnerability scanning so controls against malware entering via an upstream 3rd party.
  • Anchore
  • Clair
• One of the best practices for container development is reducing the attack surface area by maintaining a hardened and minimal base image. For example, removing any non-essential components such as shells, network utilities, and text editors. Utilising a pre-hardened image such as the CIS Images and applying
• If you manage your own Kubernetes masters and nodes then you should consider the attack vectors against that host use endpoint protection to mitigate, although if you use Hosted Kubernetes, i.e. Google Kubernetes Engine or Azure Kubernetes Service, you need to jump through some hoops to get it working. As you've probably already seen there is some basic advice on what to avoid, and you need to understand the limitations of the scanning engine - namely it can't see into containers.
  • Docker Anti-virus Exclusions - remember Kubernetes is using ContainerD
  • Kubernetes ClamAV
  • Sysdig Falco
  • Carbon Black
• Equally, masters and nodes should be leveraging SELinux as a Mandatory Access Control security mechanism and generally have the relevant CIS or STIG benchmarks applied to them.
• There are a small but growing number of "hot" container endpoint protection tools, it's fairly nascent so explore your options carefully:
  • Dagda
  • OpenSCAP
  • Sysdig Falco
• Integrity Checking is very important as whilst it isn't anti-malware per se, it is a component part of most anti-malware packages so might just give you the signal you need to know that something is wrong:
  • images should be signed, and Kubernetes should be configured to only use images signed by a trusted party.
  • hosts should absolutely employ File Integrity Monitoring with something like twistlock.
  • equally, file integrity monitoring within the container itself can be valuable.
• Finally, remember "Infrastructure as Code" if you can destroy all of your infrastructures and rebuild it from scratch automatically it makes it significantly easier to recover from a compromise. This is a tough sell with an auditor.

If you implement everything above, you will quickly find you run into information overload - this is where a Security Information and Event Management (SIEM) tool can help bring everything together in a single pane of glass.