News
The Increasing Importance of Container Security
"Perimeter security is kind of done for," says one expert.
Containerization -- essentially a stripped-down, smaller-footprint version of virtual machines (VMs) -- is rapidly gaining popularity. Along with its growth comes the need to secure the containerized applications, and those products are starting to hit the market.
Microsoft has embraced containers in a big way on its Microsoft Azure platform, and has added a new security tool to its Azure Marketplace designed to allow Java developers deploying their apps on the Azure cloud platform to "Bring Your Own Security (BYOS)." Waratek Locker, unveiled this week at the Microsoft TechEd Europe conference in Barcelona, is a containerized Runtime Application Self-Protection (RASP) product that provides security monitoring, policy enforcement and attack blocking from within the Java VM (JVM).
Analyst firm Gartner Inc. has defined RASP as "a security technology built in or linked to an application or app runtime environment, capable of controlling app execution and detecting and preventing real-time attacks."
BYOS
The Dublin-based Waratek Ltd., which specializes in Java security, is billing Locker as an all-in-one Azure Certified solution that combines the Apache
Tomcat app server (version 7) with the Waratek Application Security for Java
product. The company coined "BYOS" to describe what the RASP solution provides.
"We did come up with that," Brian Maccaba, CEO of Waratek, said. "There was BYOB, then BYOD. The idea is, you're on the cloud, but you're still controlling your own security."
The Locker virtualized container lives inside the JVM, where it can analyze app activity at runtime, Maccaba explained. From this vantage, Locker can protect apps in the cloud from exploits that target vulnerabilities in third-party libraries and malicious activity, including SQL Injection, abnormal file manipulation and unexpected network connections.
"Once it's in the virtual container, we are controlling all the APIs in the [just-in-time] compiler, so we have complete visibility of the data interacting with the code at the point of execution," Maccaba said.
Avoiding the Virtualization Tax
Containerization differs from hypervisor-based virtualization in some significant ways. Containers are lightweight, in that they carry no OS; apps within a container start up immediately, almost as fast as apps running on an OS; they're fully isolated; they consume fewer physical resources; and there's little of the performance overhead associated with virtualization -- no "virtualization tax."
A rule-based engine that admins can manage remotely protects apps deployed in Azure with Locker. With this release, that engine is preconfigured with rules that restrict app access to required files, restrict app access to required network functions and block SQL injection attacks. Waratek also offers a free Security Rules Tool for creating custom security rules.
Application layer security has become a hot topic, spurred recently by the growing interest in the Internet of Things (IoT).
"Perimeter security is kind of done for," Maccaba said. "It keeps the kids who want to steal your apples out of your orchard, but it doesn't stop the professionals who want to break into your house and steal your jewelry."
Although the Locker solution is new, Waratek has been working with the collected technologies for some time. The company chose Azure for its first branded release because of interest expressed by Microsoft.
Group Hug
"Microsoft engaged with us and made it very clear that it's extremely important to them to have best-of-breed Java and Linux technologies on Azure," Maccaba said. "Which makes sense. [Microsoft] can only win the enterprise cloud war long-term if the [company] can prove that [it still has] the best non-Microsoft technologies, as well as Microsoft tech. [It's] making a very conscious effort, and [the company] just sort of wrapped [its] arms around us."
"Companies want to take advantage of the performance, scalability, and elasticity of Azure to run their enterprise applications, while maintaining control over security," said Garth Fort, GM of the Microsoft Enterprise Partners group in a statement. "Technologies like Waratek Locker, that enable security policies and controls to follow applications, make it even easier to move mission-critical apps to the cloud."
Waratek is likely to release Locker for other cloud platforms in the future, Maccaba said.
About the Author
John K. Waters is the editor in chief of a number of Converge360.com sites, with a focus on high-end development, AI and future tech. He's been writing about cutting-edge technologies and culture of Silicon Valley for more than two decades, and he's written more than a dozen books. He also co-scripted the documentary film Silicon Valley: A 100 Year Renaissance, which aired on PBS. He can be reached at [email protected].