{
  "node_id": "nist-sp-800-190-container-security",
  "title": "Application Container Security Guide",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2017-09-30",
  "bluf": "Application container technologies are a form of operating system virtualization combined with application software packaging that provide a portable, reusable, and automatable way to package and run applications. This publication explains the potential security concerns associated with the use of containers and provides practical recommendations for addressing those concerns for system administrators, security managers, developers, and others responsible for the security of application container technologies. The core risks involve vulnerabilities and misconfigurations within container images, insecure connections to registries, unbounded administrative access to orchestrators, and the inherent risks of a shared kernel on the host OS.\n\nTo mitigate these risks, organizations should tailor their operational culture and technical processes for containerized environments. Key recommendations include using minimalist, container-specific host operating systems to reduce attack surfaces; grouping containers by purpose, sensitivity, and threat posture on a single host for defense-in-depth; adopting container-specific vulnerability management tools and processes to scan images for flaws; considering hardware-based countermeasures like a Trusted Platform Module (TPM) to establish a root of trust; and deploying container-aware runtime defense tools to monitor and respond to anomalous activity.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-53-r5",
    "nist-cybersecurity-framework-2-0",
    "nist-sp-800-128-config-management",
    "nist-sp-800-218-ssdf",
    "nist-ir-8176-linux-container-security"
  ],
  "primary_citations_count": 8
}