The Impact of Supply Chain Attacks on Cloud Container Security

Cloud containers are in demand, and why not? They make it effortless for software developers to build applications, run them in any environment, and test and deploy them faster.

Unfortunately, this demand has attracted cyberattackers who are looking to exploit vulnerabilities in containers.

According to reports, supply chain attacks have increased by 430%. Attackers target weaker software vendors or third-party service providers, etc. to get to bigger targets. This means organisations need to ensure they use secure third-party services to protect their data and systems, including cloud containers.

Let’s understand what supply chain attacks are and how they affect container security.

A supply chain attack is a cybersecurity attack where the attacker aims to infiltrate an organisation’s network or systems by targeting weaker systems in their supply chain. These less secure systems are third-party software or services that a company trusts and uses in its operations.

Malicious actors may find and exploit vulnerabilities in third-party services or inject malware in software code. When the targeted company uses the services with malware in them or downloads a system update, it becomes easier for the attackers to gain access to the company's network, data, and systems and cause harm.

Supply chain attacks target all industries that use third-party services or software. It could be a financial firm, government organisation, IT company, manufacturing firm, ecommerce brand, and so on. This means you need to create a solid third-party risk management plan and prevent supply chain attacks.

Examples of Supply Chain Attacks

SolarWinds Orion
In December 2020, a supply chain attack targeted Orion, a monitoring software by SolarWinds. Attackers distributed the malware as a part of a system update, which went unnoticed as it had a legitimate digital signature. Around 18,000 users, including government entities, organisations, and businesses from North America, Europe, the Middle East, and Asia fell victim to this attack.

Mimecast
In January 2021, attackers compromised the authentication certificate for Mimecast’s Continuity Monitor, Internal Email Protect, and Sync and Recover on Microsoft 365. It affected around 10% of its users that used the certificate-based connection.

Codecov
The code audit and management solution provider, Codecov faced a supply chain attack in April 2021. A cyberattacker exploited an error in the Docker imaging by Codecov and extracted the credentials to compromise its Bash uploader script.

Other examples include the Kaseya attack, the NotPetya attack, the WannaCry attack, and more.

Types of Supply Chain Attacks

The supply chain of an organisation refers to the network of resources, software, hardware, people, technologies, tools, companies, and services taking part in creating and delivering a product. Supply chain cyber threats target the supply chain of a company that uses third-party software or hardware systems to disrupt its operations or steal data. Here are some of the types of supply chain attacks:

Open-source: If third-party open-source software has vulnerabilities, attackers could exploit them to compromise the target organisation’s systems and networks.

Software-based: These happen due to malicious code injections in software updates. A user’s system automatically downloads this update assuming it’s trusted, which infects the system.

Browser-based: Attackers target user browsers by running malicious code on them that gets executed automatically on their devices, stealing data.

JavaScript-based: A web page with malicious scripts embedded in it or security vulnerabilities in a piece of JavaScript code could lead to JavaScript attacks when users execute the web page or run the code.

Stolen certificates: A cyberattacker steals authentication keys and certificates (like SSL certificates) that are used to secure cloud services and websites. They inject malware code under those certificates to access systems.

Compromised development tools: Hackers infect software development tools, such as CI/CD tools or clone GitHub repositories. When a company uses these infected tools to create software, it creates security loopholes that attackers can easily compromise.

Dependency confusion attacks: An attacker creates a software dependency that has the same name as the original/legitimate one created by a company. But, the attacker gives the false dependency a higher version and stores it on a publicly accessible repository. If a developer uses the false one to create their software build, they get trapped.

A cloud container is a software unit that “contains” or packages an application’s code and dependencies, such as libraries, programming language versions, etc. The packaging is done in a standardised way so that the applications become mobile and run in any location or environment – desktop, mobile devices, on-premises, or in the cloud.

This means cloud containers virtualise operating systems (OSes) and leverage the OS kernel to separate the application from other processes. Containers also control the memory, disk space, and CPU amounts for those processes so the app runs in any environment.

This is how containerisation technology works, allowing development teams to be agile, operate with greater efficiency and deploy software faster. Compared to conventional virtual machines (VMs), cloud containers make it easier to build, test, and deploy applications as well as apply patches and updates.

No wonder why the demand for containers for software development has increased. According to Statista, 61% of respondents accepted using over 250 containers. By 2024, the container management market size is US$ 944 million.

However, this growing need for cloud containers has attracted cyber criminals who are finding ways to exploit these containers and supply chains with advanced attacks. According to a study, 59% of respondents said that they had faced security incidents in their container environments.

Reason: API vulnerabilities, network breaches, and certificate misconfiguration

Cyberattacks on cloud containers have serious effects, such as delayed software launch, disruptions in serving application users, operational disturbances, compliance violations, and more.

This is why security teams must have a deeper understanding of containerisation and other cloud-native environments to protect applications, networks, systems, and data from cyberattacks.

The irony is the same features that make cloud containers so useful also introduce security vulnerabilities in containers. For example, cloud containers use many open-source components and shared libraries, which could have vulnerabilities that hackers can find and exploit.
Here’s how cyber attacks in supply chains affect container security by exploiting vulnerabilities in containers:

Compromised Container Image Registries
A container image holds all the information, such as application code, libraries, operating systems, and other dependencies required to run the application. Container images are stored in a repository in a container image format, such as Open Container Initiative (OCI). From here, a container engine (such as Docker, CRI-O, or Containerd) pulls these images and runs them on a container host (eg. a desktop, laptop, server, or public cloud).

However, publicly accessible container images often have security vulnerabilities. According to reports, 87% of container images have high-severity vulnerabilities. This is because organisations are rushing their cloud deployments. An attacker can find and exploit these vulnerabilities to compromise containers. They can also add a malicious image to the registry to compromise a user’s systems and data when they use the compromised container image.

CI/CD Pipeline Vulnerabilities
Supply chain attacks compromise software development tools, such as CI/CD pipelines to introduce malware into an organisation’s production environment. No matter how secure your containers are, if you use infected build processes in your software development, it will jeopardise your container’s security.

Insecure Dependencies
As discussed earlier, containers use many open-source libraries, third-party components, and other dependencies. These dependencies could have security vulnerabilities, especially open-source components with no dedicated maintenance team. A supply chain attack could compromise these components.

So, when you use a compromised component in your container, it affects your container’s security. You could end up giving access to your data and systems without even realising it.

Misconfigurations
Managing containers is tricky and risky because of their multi-layered deployments. Although there are container management solutions available, such as Kubernetes or Docker Swarm that offer great visibility on these containers, it adds to operational complexity.

Due to complexity, misconfiguration risks increase, which opens the door to more cyber attacks. In 2019, an attacker exploited a weak security configuration used for storing tokens and keys. This led Docker Hub to lose tokens and keys of around 190k accounts.

Supply chain attacks on containers can impact an organisation severely:

Data Breaches
If there are no authentication mechanisms in place, anyone who discovers exposed container image registries can access them. This makes it easier for attackers to manipulate container images stored in those registries and push malicious images into them.

So, attackers can access sensitive data, such as source code, database credentials, API keys, tokens, etc., stored in container images. They can misuse it for their own benefit, for instance, to gain unauthorised access to devices and systems, launch a widespread cyberattack, steal data and sell it on the dark web or to competitors, and so on. This causes organisations to lose business and customer trust.

Service Disruptions
A supply chain attack on your containers could disrupt your operations big time.
For example, if you face a DDoS attack, it will leave your applications or website unresponsive. You won’t be able to take new orders or respond to your customers. Similarly, if an attacker compromises your systems or credentials, you won’t be able to use those systems and your operations will be delayed.

This means you will lag behind in your business goals, witness lower employee productivity and morale, and frustrated customers. You also need to invest a significant amount in recovering from the attack and reducing its impact.

Regulatory Penalties
Data privacy laws and regulations, such as UK GDPR, HIPAA, SAMA, etc. are getting stricter these days as data theft instances keep on growing. Organisations need to comply with these standards to secure customer data and business from threats.

Supply chain attacks on your containers could expose sensitive data to the public, such as API keys and credentials that may belong to customers. So, apart from affecting your finances and operations, it could lead to regulatory penalties and heavy fines. You could also lose the trust of your customers, partners, and investors.

Here are some of the supply chain attack prevention strategies you can consider to protect your cloud containers:

Use Strong Authentication and Authorisation
Use authentication and authorisation mechanisms, such as multi-factor authentication (MFA), single sign-on, biometrics, etc. to secure your container image registries. This means individuals with proper credentials can only access your images in a repository. It will prevent unauthorised individuals from accessing or tampering with your container images and help mitigate cyberattacks.

Regular Image Scanning
Make it a practice to scan your container images regularly to detect container vulnerabilities and resolve them before they can convert into a cyberattack. You can use tools, such as vulnerability scanners to scan images automatically when a new one is pushed to the container registry. It will also alert users if it detects any vulnerabilities or risks. This way, you can protect your container from supply chain attacks.

Manage Image Integrity
To ensure users find the right container images that you have approved and stored and not a malicious image by an attacker, manage the image’s integrity. You can use methods, such as digital signatures that track, fingerprint, and store scanned images automatically. This helps prevent users from accessing suspicious or unknown images.

In addition, you can create an internal registry with curated images that you have approved. Limit access to your registries with stronger policies so that each image will be vetted before being pushed into the registry.

Use Secure Components
Supply chain attacks exploit the vulnerabilities in insecure, third-party components, such as open-source libraries, developer tools, etc. If your container has insecure dependencies, it’s risky.

This is why you must always use trusted and secure libraries and other components. Before you choose a tool, carefully vet its security mechanisms and then implement it in your container or software development lifecycle. This also helps you manage open-source supply chain security.

Implement Robust Access Controls
In addition to authentication and authorisation mechanisms, use robust access control policies for your containers. Implement zero trust cloud container security to protect your container and data from known and unknown threats. It’s based on the principle that you should trust no one when it comes to securing your container as attacks can come from outside and even from inside of your organisation.

Apart from zero trust, you can implement identity and access management (IAM) solutions in your containers so that only the right people with the right permissions can access your registries. You can also implement policies, such as least privileged access (LPA) to control who can access your containers and at what level.

Set Up Strict Firewall Rules
The more cybersecurity measures you implement, the better your defence mechanisms will be. So, set up stronger firewall rules to secure your connections by blocking unwanted or suspicious connections. Monitor your systems and services continuously to detect risks and neutralise them in time.

Encrypt Data
Always encrypt your data no matter if it’s in rest or transit. Even if an attacker manages to intercept your connection, they won’t be able to read the content inside your container. So, look for a reliable data encryption tool based on your needs to encrypt and protect your data from leaks or breaches.

Patch and Update Registry
As with other software and applications you use that require regular updates and patches, you must also maintain your container image registries. This helps resolve vulnerabilities, bugs, and errors in various components so that no one can find or exploit your container images. In addition, periodic updates provide the latest features and functionalities that increase your container’s security and speed up your software deployment lifecycles.

Talk to our experts today

Development teams can use cloud containers to easily create, test, and deploy applications but container vulnerabilities could lead to cyberattacks. At Microminder, we ensure you only get the benefits of containerisation without risks because we are there to protect your containers.

We offer comprehensive cloud container security solutions and services to defend your assets from malicious actors and provide you with a secure cloud infrastructure. This is how we do it:

• Scan your containers regularly for vulnerabilities
• Detect and fix vulnerabilities before you deploy your code
• Manage container image integrity with role-based access controls (RBAC), identity and access management (IAM), zero trust security, and authentication and authorisation controls
• Test and validate your application’s security with penetration testing
• Securing your applications even after deployment with threat intelligence, incident detection and response, etc.
  
  Talk to our experts to get started with our Cloud Container Security services.