There’s Finally a Way to Improve Cloud Container Registry Security

technohoop


As software supply chain attacks have emerged as an everyday threat, where bad actors poison a step in the development or distribution process, the tech industry has had a wake-up call about the need to secure each link in the chain. But actually implementing improvements is challenging, particularly for the sprawling open source cloud development ecosystem. Now, the security firm Chainguard says it has a more secure solution for one ubiquitous but long-overlooked component.

“Container registries” are a sort of app store or clearinghouse where developers upload “images” of cloud containers that each hold a different software program. The cloud services you use every day are constantly and silently navigating container registries to access applications, but these registries are often poorly secured with just a password that can be lost, stolen, or guessed. This often means that people who shouldn’t have access to a given container image can download it or, worse, they can upload to the registry images that could be malicious. Chainguard’s new container image registry aims to plug this esoteric but pervasive hole.

 “Pretty much every bad possible thing has happened with container registries that you can imagine,” says Dan Lorenc, Chainguard’s CEO and a longtime software supply chain security researcher. “People losing passwords, people pushing malware on purpose, people forgetting to update stuff. The industry has just kind of been using this for a long time—everyone was having fun, shipping code, and nobody was thinking about long-term consequences.”

The Chainguard researchers say they have long considered developing a more thoughtfully designed registry, particularly one that gets rid of passwords and instead uses a single sign-on approach to control registry access. That way, a registry can be designed to be as accessible or as locked down as needed, and only people who are logged into other accounts, like corporate identity services or Google accounts, and then specifically authorized can interact with the registry.

“Container registries have been a weak link,” says Jason Hall, a Chainguard software engineer. “They’re pretty boring, pretty standard. This is software that’s relying on software to deliver software. We need to do better and get rid of passwords to talk to the registry and be able to push to the registry.”

The big limitation on deploying a system like this, though, has been cost. Running a container registry typically gets very expensive because of “egress fees.” In other words, cloud providers don’t charge enterprise customers to upload data into the cloud, but they do charge them every time someone downloads the data. So if container registries are like an app store where everyone is coming to download container images, the egress fees can get really big really fast. This disincentivized work on overhauling the security of container registries because no one wanted to take on the cost associated with offering a more secure alternative.

The breakthrough for Chainguard came when the internet infrastructure company Cloudflare announced the general availability of its R2 Storage service in September. The goal of the product is to offer reduced egress fees to Cloudflare customers and even no fees for data that gets downloaded infrequently. Once R2 emerged as an option, the Chainguard researchers had everything they needed to move ahead with a more secure registry.



Source link

Leave a Comment

indian couple car sex tubexo.info indian hot sex tubes sex videos of sunny leon meyzo.me old hindi sexy video 9xmovies.asia blueporn.mobi bollywood rape scenes indian girls naked video tubereserve.mobi womensexwithanimals チ○ポが好きすぎて好奇心で応募してきた美人秘書 フェラチオの女神avデビュー!! 安藤かれん javpussy.net 肉感!ol倶楽部~爆乳olみいなさんのパツパツスーツとヤリすぎグラマラススタイル~ 若月みいな playboy calendar sexo-vids.com xnxx hinbi threesome hot sex videos fapvid.mobi xxx kannda videos علا غانم سكس porno-deutsche.com مايا خليفه سكس cool sex xxx desixxxtube.info arab sex video sukanya actress fuxee.mobi anushka shetty and prabhas صور سكس يباني best-pornos.com فضيحة منى الغضبان leona explosion byhentai.com tales of zestiria x hentai hot live porn xxxfiretube.com tamil girl sex film dps kand sexotube.info indianporn video hindi chudachudi ultraporn.mobi pornhub sunny leon