Credential safety management for software containers
An example computer-implemented method of providing security for a software container includes discovering credentials that a software container is expected to use at runtime. The discovering is performed prior to instantiation of the software container from a container image, and is based on one or more of credentials stored in the container image, credentials stored in runtime configuration data for the software container, and credentials from a secrets management service. An unsafe credential set is determined that includes one or more of the discovered credentials that do not meet predefined credential safety criteria. A runtime request is intercepted from the software container. A credential violation is detected based on the intercepted runtime request attempting to use a credential from the unsafe discovered credential set. A corrective action is performed for the software container based on the detected credential violation.
1. A computer-implemented method of providing security for a software container, comprising:
discovering credentials that a software container is expected to use at runtime, the discovering performed prior to instantiation of the software container from a container image, the discovering based on one or more of credentials stored in the container image, credentials stored in runtime configuration data for the software container, and credentials from a secrets management service;
determining an unsafe credential set that includes one or more of the discovered credentials that do not meet predefined credential safety criteria;
intercepting a runtime request from the software container during runtime of a software application in the software container;
detecting a credential violation based on the intercepted runtime request attempting to use a credential from the unsafe credential set; and
performing a corrective action for the software container based on the detected credential violation.
2. The computer-implemented method of claim 1 , wherein said discovering credentials comprises performing pre-runtime scanning for credentials in expected credential storage locations of the container image.
3. The computer-implemented method of claim 1 , wherein:
said discovering is based on credentials stored in runtime configuration data for the software container; and
said discovering credentials comprises querying a container orchestrator for credentials stored in the runtime configuration data, wherein the container orchestrator is configured to control resource management for a plurality of host computing devices that are configured to run the software container and a plurality of additional software containers.
4. The computer-implemented method of claim 1 , wherein:
said discovering is based on credentials from a secrets management service; and
said discovering credentials comprises querying the secrets management service for credentials for the container image, wherein the secrets management service is configured to provide credentials for a plurality of container images.
5. The computer-implemented method of claim 1 , comprising storing the discovered credentials in a discovered credential repository along with an identifier of the container image to which they correspond, wherein the discovered credential repository is separate from the container image.
6. The computer-implemented method of claim 5 , comprising salting the discovered credentials, hashing the discovered credentials, or both, prior to storing the discovered credentials in the discovered credential repository.
7. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential has been in use for longer than a predefined allowable usage period, or is derived from a credential that has been in use for longer than the predefined allowable usage period.
8. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is stored in the container image.
9. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is discoverable through a dictionary attack.
10. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is stored in a publicly-accessible source code repository.
11. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is not obtained from the secrets management service for the software container.
12. The computer-implemented method of claim 1 , wherein said performing a corrective action based on the detected credential violation comprises preventing execution of the intercepted runtime request.
13. The computer-implemented method of claim 1 , wherein said performing a corrective action based on the detected credential violation comprises substituting the credential from the unsafe credential set with a safe credential, and executing the intercepted runtime request with the safe credential.
14. The computer-implemented method of claim 13 , wherein said substituting the credential comprises dynamically obtaining a credential for the software container from the secrets management service, and utilizing the credential from the secrets management service as the safe credential.
15. The computer-implemented method of claim 1 , wherein said performing a corrective action based on the detected credential violation comprises providing an alert that the software container is attempting to use an unsafe credential.
16. The computer-implemented method of claim 1 , wherein the predefined credential safety criteria is based on at least two of credential strength, credential retrievability, credential reuse, or credential exhaustion.
17. A credential safety management system comprising:
processing circuitry operatively connected to memory and configured to:
discover credentials that a software container is expected to use at runtime prior to instantiation of the software container from a container image, the discovery based on one or more of credentials stored in the container image, credentials stored in runtime configuration data for the software container, and credentials from a secrets management service; and
determine an unsafe credential set that includes one or more of the discovered credentials that do not meet predefined credential safety criteria; and
a runtime service configured to:
intercept a runtime request from the software container during runtime of a software application in the software container;
detect a credential violation based on the intercepted runtime request attempting to use a credential from the unsafe credential set; and
perform a corrective action for the software container based on the detected credential violation.
18. The credential safety management system of claim 17 , wherein to discover the credentials, the processing circuitry is configured to perform pre-runtime scanning for credentials in expected credential storage locations of the container image.
19. The credential safety management system of claim 17 , wherein:
the discovery is based on credentials stored in runtime configuration data for the software container; and
to discover the credentials, the processing circuitry is configured to query a container orchestrator for credentials stored in the runtime configuration data, wherein the container orchestrator is configured to control resource management for a plurality of host computing devices that are configured to run the software container and a plurality of additional software containers.
20. The credential safety management system of claim 17 , wherein:
the discovery is based on credentials from a secrets management service; and
to discover the credentials, the processing circuitry is configured to query the secrets management service for credentials for the container image, wherein the secrets management service is configured to provide credentials for a plurality of container images.
21. The credential safety management system of claim 17 , wherein the processing circuitry is configured to store the discovered credentials in a discovered credential repository along with an identifier of the container image to which they correspond, wherein the discovered credential repository is separate from the container image.
22. The credential safety management system of claim 21 , wherein:
to store the discovered credentials in the discovered credential repository, the processing circuitry is configured to store identifiers of modifiers that can modify the discovered credentials at runtime, the modifiers including one or more of environment variables, command line arguments, and configuration files; and
to detect a credential violation based on the intercepted runtime request attempting to use a credential from the unsafe credential set, the processing circuitry is configured to detect that the intercepted runtime request is attempting to utilize a modified credential that is modified by one of the modifiers and does not meet the predefined credential safety criteria.
23. The credential safety management system of claim 21 , wherein the processing circuitry is configured to salt the discovered credentials, hash the discovered credentials, or both, prior to storing the discovered credentials in the discovered credential repository.
24. The credential safety management system of claim 21 , wherein:
the processing circuitry is configured to determine whether a discovered credential is unsafe based on whether the discovered credential is stored in the discovered credential repository for one or more other software containers;
the processing circuitry is configured to determine that the software container is part of a container group of related software containers; and
the predefined credential safety criteria indicates that a credential is unsafe if it is stored in the discovered credential repository and is associated with multiple container groups.
25. The credential safety management system of claim 17 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential has been in use for longer than a predefined allowable usage period, or is derived from a credential that has been in use for longer than the predefined allowable usage period.
26. The credential safety management system of claim 17 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is stored in the container image.
27. The credential safety management system of claim 17 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is discoverable through a dictionary attack.
28. The credential safety management system of claim 17 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is stored in a publicly-accessible source code repository.
29. The credential safety management system of claim 17 , wherein the predefined credential safety criteria indicates that a credential is unsafe if the credential is not obtained from the secrets management service for the software container.
30. The credential safety management system of claim 17 , wherein said performing a corrective action based on the detected credential violation comprises preventing execution of the intercepted runtime request.
31. The credential safety management system of claim 17 , wherein to perform a corrective action based on the detected credential violation, the processing circuitry is configured to substitute the credential from the unsafe credential set with a safe credential, and execute the intercepted runtime request with the safe credential.
32. The credential safety management system of claim 31 , wherein to substitute the credential, the processing circuitry is configured to dynamically obtain a credential for the software container from the secrets management service, and utilize the credential from the secrets management service as the safe credential.
33. The credential safety management system of claim 17 , wherein to perform a corrective action based on the detected credential violation, the processing circuitry is configured to provide an alert that the software container is attempting to use an unsafe credential.
34. The credential safety management system of claim 17 , wherein the predefined credential safety criteria is based on at least two of credential strength, credential retrievability, credential reuse, or credential exhaustion.