<p>This is an area where you will need to talk directly to and potentially help educate your auditors.  What you have to remember is they are responsible for ensuring that <strong>adequate controls</strong> are applied, not specifically that "Production Servers have Endpoint Protection"; Anti-virus and Anti-malware are among some of the most basic controls applied to technology.</p>

<p>As a bit of a starter for ten, you could consider the following:</p>

<ul>
<li><strong>Secure Software Development Lifecycle (S-SDLC)</strong>: In traditional environments, developer and administrator workstations would have Anti-virus and Anti-malware products installed, therefore any code that a developer creates and an administrator deploys will have been subject to routine automatic scans.  It's easy to forget that the same controls need to be applied to our automated pipelines, one option would be to scan both source code and artefacts <a href="https://www.clamav.net/" rel="noreferrer">with ClamAV</a> or a commercial antivirus product.

<ul>
<li><a href="https://github.com/aquasecurity/trivy" rel="noreferrer">Trivy</a> - not anti-virus but does offer vulnerability scanning so controls against malware entering via an upstream 3rd party.</li>
<li><a href="https://anchore.com/" rel="noreferrer">Anchore</a></li>
<li><a href="https://github.com/coreos/clair" rel="noreferrer">Clair</a></li>
</ul></li>
<li>One of the best practices for container development is <strong>reducing the attack surface area</strong> by maintaining a hardened and minimal base image.  For example, removing any non-essential components such as shells, network utilities, and text editors.  Utilising a pre-hardened image such as the <a href="https://www.cisecurity.org/press-release/cis-introduces-hardened-container-image-with-amazon/" rel="noreferrer">CIS Images</a> and applying </li>
<li>If you manage your own Kubernetes masters and nodes then you should consider the attack vectors against that host <strong>use endpoint protection to mitigate</strong>, although if you use Hosted Kubernetes, i.e. Google Kubernetes Engine or Azure Kubernetes Service, you need to <a href="https://cloud.google.com/solutions/installing-antivirus-and-file-integrity-monitoring-on-container-optimized-os" rel="noreferrer">jump through some hoops</a> to get it working.  As you've probably already seen there is some basic advice on what to avoid, and you need to understand the limitations of the scanning engine - namely it can't see <em>into</em> containers.

<ul>
<li><a href="https://docs.docker.com/engine/security/antivirus/" rel="noreferrer">Docker Anti-virus Exclusions</a> - remember Kubernetes is using ContainerD</li>
<li><a href="https://cloud.google.com/community/tutorials/gcp-cos-clamav" rel="noreferrer">Kubernetes ClamAV</a></li>
<li><a href="https://github.com/draios/falco/wiki/How-to-Install-Falco-for-Linux" rel="noreferrer">Sysdig Falco</a></li>
<li><a href="https://www.globenewswire.com/news-release/2019/06/25/1873863/0/en/Carbon-Black-Adds-Cloud-Workload-and-Container-Protection-to-Its-Cloud-Native-Endpoint-Protection-Platform-EPP.html" rel="noreferrer">Carbon Black</a></li>
</ul></li>
<li>Equally, masters and nodes should be <strong><a href="https://wiki.centos.org/HowTos/SELinux" rel="noreferrer">leveraging SELinux</a></strong> as a Mandatory Access Control security mechanism and generally have the relevant <a href="https://docs.docker.com/v17.09/compliance/cis/" rel="noreferrer">CIS</a> or <a href="https://public.cyber.mil/stigs/" rel="noreferrer">STIG</a> benchmarks applied to them.</li>
<li>There are a small but growing number of "hot" <strong>container endpoint protection tools</strong>, it's fairly nascent so explore your options carefully:

<ul>
<li><a href="https://github.com/eliasgranderubio/dagda/" rel="noreferrer">Dagda</a></li>
<li><a href="https://github.com/OpenSCAP" rel="noreferrer">OpenSCAP</a></li>
<li><a href="https://github.com/draios/falco/wiki/How-to-Install-Falco-using-Containers-and-or-Orchestration" rel="noreferrer">Sysdig Falco</a></li>
</ul></li>
<li><strong>Integrity Checking</strong> is very important as whilst it isn't anti-malware per se, it is a component part of most anti-malware packages so might just give you the signal you need to know that something is wrong:

<ul>
<li><a href="https://docs.docker.com/v17.09/datacenter/dtr/2.2/guides/user/manage-images/sign-images/" rel="noreferrer">images should be signed</a>, and Kubernetes should be <a href="https://www.docker.com/blog/secure-supply-chain-for-kubernetes-part-2/" rel="noreferrer">configured</a> to only use images signed by a trusted party.</li>
<li>hosts should absolutely employ File Integrity Monitoring with <a href="https://www.twistlock.com/2019/03/05/file-integrity-monitoring-securing-hosts/" rel="noreferrer">something like twistlock</a>.</li>
<li>equally, file integrity monitoring <a href="https://clustergarage.io/argus/" rel="noreferrer">within the container</a> itself can be valuable.</li>
</ul></li>
<li>Finally, remember "Infrastructure as Code" if you can destroy all of your infrastructures and rebuild it from scratch automatically it makes it <strong>significantly easier</strong> to recover from a compromise.  This is a tough sell with an auditor.</li>
</ul>

<p>If you implement everything above, you will quickly find you run into information overload - this is where a Security Information and Event Management (SIEM) tool can help bring everything together in a single pane of glass.</p>

CC BY-SA 4.0
2019-11-11T08:52:14.887Z
You're welcome @Roly, and I would be delighted that as you go through the process of getting your SOC2 report, you could take a bit of time to let us know what you ended up doing to "adequately control" for the risks of malicious software and code.
Richard Slater
CC BY-SA 4.0
2019-11-07T19:51:19.653Z
2019-11-07T20:37:56.387Z
2019-11-07T20:37:56.387Z
Richard Slater
<p>One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for this in the container world. I'm not sure if it's a good practice to run AV on the host OS? Some materials I found in my Googling seem to indicate that if you do something like that, you would need to exclude the files used by the container to avoid locking up the container. Which sounds like it would defeat the purpose.</p>

<p>In our particular case, we're running on GKE using Google's pre-made container OS. Anyone have experience with this?</p>

<kubernetes><containers><security>
What are the best practices for anti-virus / anti-malware when using containers?
Roly
# What are the best practices for anti-virus / anti-malware when using containers?

(Asked by: username_0 on 2019-11-07)

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for this in the container world. I'm not sure if it's a good practice to run AV on the host OS? Some materials I found in my Googling seem to indicate that if you do something like that, you would need to exclude the files used by the container to avoid locking up the container. Which sounds like it would defeat the purpose.

In our particular case, we're running on GKE using Google's pre-made container OS. Anyone have experience with this?

**Tags:** kubernetes, containers, security


---

## 1 answers

### Answer by username_1 on 2019-11-07. Score: 12 | Accepted answer

This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that **adequate controls** are applied, not specifically that "Production Servers have Endpoint Protection"; Anti-virus and Anti-malware are among some of the most basic controls applied to technology.

As a bit of a starter for ten, you could consider the following:

* **Secure Software Development Lifecycle (S-SDLC)**: In traditional environments, developer and administrator workstations would have Anti-virus and Anti-malware products installed, therefore any code that a developer creates and an administrator deploys will have been subject to routine automatic scans. It's easy to forget that the same controls need to be applied to our automated pipelines, one option would be to scan both source code and artefacts [with ClamAV](https://www.clamav.net/) or a commercial antivirus product.
  + [Trivy](https://github.com/aquasecurity/trivy) - not anti-virus but does offer vulnerability scanning so controls against malware entering via an upstream 3rd party.
  + [Anchore](https://anchore.com/)
  + [Clair](https://github.com/coreos/clair)
* One of the best practices for container development is **reducing the attack surface area** by maintaining a hardened and minimal base image. For example, removing any non-essential components such as shells, network utilities, and text editors. Utilising a pre-hardened image such as the [CIS Images](https://www.cisecurity.org/press-release/cis-introduces-hardened-container-image-with-amazon/) and applying
* If you manage your own Kubernetes masters and nodes then you should consider the attack vectors against that host **use endpoint protection to mitigate**, although if you use Hosted Kubernetes, i.e. Google Kubernetes Engine or Azure Kubernetes Service, you need to [jump through some hoops](https://cloud.google.com/solutions/installing-antivirus-and-file-integrity-monitoring-on-container-optimized-os) to get it working. As you've probably already seen there is some basic advice on what to avoid, and you need to understand the limitations of the scanning engine - namely it can't see *into* containers.
  + [Docker Anti-virus Exclusions](https://docs.docker.com/engine/security/antivirus/) - remember Kubernetes is using ContainerD
  + [Kubernetes ClamAV](https://cloud.google.com/community/tutorials/gcp-cos-clamav)
  + [Sysdig Falco](https://github.com/draios/falco/wiki/How-to-Install-Falco-for-Linux)
  + [Carbon Black](https://www.globenewswire.com/news-release/2019/06/25/1873863/0/en/Carbon-Black-Adds-Cloud-Workload-and-Container-Protection-to-Its-Cloud-Native-Endpoint-Protection-Platform-EPP.html)
* Equally, masters and nodes should be **[leveraging SELinux](https://wiki.centos.org/HowTos/SELinux)** as a Mandatory Access Control security mechanism and generally have the relevant [CIS](https://docs.docker.com/v17.09/compliance/cis/) or [STIG](https://public.cyber.mil/stigs/) benchmarks applied to them.
* There are a small but growing number of "hot" **container endpoint protection tools**, it's fairly nascent so explore your options carefully:
  + [Dagda](https://github.com/eliasgranderubio/dagda/)
  + [OpenSCAP](https://github.com/OpenSCAP)
  + [Sysdig Falco](https://github.com/draios/falco/wiki/How-to-Install-Falco-using-Containers-and-or-Orchestration)
* **Integrity Checking** is very important as whilst it isn't anti-malware per se, it is a component part of most anti-malware packages so might just give you the signal you need to know that something is wrong:
  + [images should be signed](https://docs.docker.com/v17.09/datacenter/dtr/2.2/guides/user/manage-images/sign-images/), and Kubernetes should be [configured](https://www.docker.com/blog/secure-supply-chain-for-kubernetes-part-2/) to only use images signed by a trusted party.
  + hosts should absolutely employ File Integrity Monitoring with [something like twistlock](https://www.twistlock.com/2019/03/05/file-integrity-monitoring-securing-hosts/).
  + equally, file integrity monitoring [within the container](https://clustergarage.io/argus/) itself can be valuable.
* Finally, remember "Infrastructure as Code" if you can destroy all of your infrastructures and rebuild it from scratch automatically it makes it **significantly easier** to recover from a compromise. This is a tough sell with an auditor.

If you implement everything above, you will quickly find you run into information overload - this is where a Security Information and Event Management (SIEM) tool can help bring everything together in a single pane of glass.

> **Comments:**
> **username_1**: You're welcome @username_0, and I would be delighted that as you go through the process of getting your SOC2 report, you could take a bit of time to let us know what you ended up doing to "adequately control" for the risks of malicious software and code.  

---

