{"id":45,"date":"2020-11-11T19:55:00","date_gmt":"2020-11-11T19:55:00","guid":{"rendered":"http:\/\/blog.firatyasar.com\/?p=45"},"modified":"2021-03-31T19:58:28","modified_gmt":"2021-03-31T19:58:28","slug":"container-security-best-practise-build-phase","status":"publish","type":"post","link":"https:\/\/blog.firatyasar.com\/?p=45","title":{"rendered":"Container Security Best Practise &#8211; Build Phase"},"content":{"rendered":"\n<p>Enterprise seviyede container stratejisi belirlenirken en \u00f6nce d\u00fc\u015f\u00fcn\u00fclmesi gereken \u015fey g\u00fcvenlik olmal\u0131d\u0131r. Ba\u015far\u0131l\u0131 bir container g\u00fcvenlik stratejisi container\u2019\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn \u00fc\u00e7 ana bile\u015feni olan Build, Deploy ve Run a\u015famalar\u0131n\u0131n her birine entegre olmal\u0131d\u0131r.<\/p>\n\n\n\n<ul><li>Build<\/li><li>Deploy<\/li><li><strong>Run<\/strong><\/li><\/ul>\n\n\n\n<p>T\u00fcm bunlar\u0131n yan\u0131nda \u00f6nemli olan bir di\u011fer durum ise container\u2019\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn yan\u0131nda container\u2019lar\u0131 \u00fczerinde \u00e7al\u0131\u015ft\u0131ran alt yap\u0131n\u0131n da d\u00fczg\u00fcn \u015fekilde\u00a0configure edilmi\u015f olmas\u0131 gerekir. Bu konfig\u00fcrasyonlar d\u00fczg\u00fcn yap\u0131ld\u0131\u011f\u0131 taktirde do\u011fru se\u00e7ilmi\u015f bir container security tool\u2019u cluster altyap\u0131s\u0131n\u0131n, orchestrator mekanizmas\u0131n\u0131n ve containerized edilmi\u015f uygulaman\u0131n g\u00fcvenli olmas\u0131n\u0131 sa\u011flayacakt\u0131r.<\/p>\n\n\n\n<p>Build Phase:<\/p>\n\n\n\n<ol><li>Var olan bir problemin build a\u015famas\u0131nda saptanmas\u0131 run time\u2019da saptanmas\u0131ndan daha efektiftir. Ayr\u0131ca bir \u00e7ok team taraf\u0131ndan kullan\u0131lan base bir imaj \u00fczerindeki sorunun build a\u015famas\u0131nda giderilmesi runtime\u2019a d\u00fczeltilmeye \u00e7al\u0131\u015f\u0131lmas\u0131ndan daha efektif olacakt\u0131r.<\/li><li>Container imaj security denildi\u011finde akla gelen ilk bile\u015fen Vulnerability taramas\u0131d\u0131r. Container security \u00e7\u00f6z\u00fcmleri bu taramalar\u0131 olduk\u00e7a esnek bir bi\u00e7imde yap\u0131p saptanan tehditlerin otomatik olarak bloklanmas\u0131n\u0131 sa\u011flarlar.<\/li><li>Uygun bir container security \u00e7\u00f6z\u00fcmleri ayr\u0131ca build a\u015famas\u0131nda security practise\u2019lerine uygun olarak compliance \u00f6l\u00e7\u00fcm\u00fcde yapmal\u0131d\u0131r. \u00d6rne\u011fin developer\u2019lar i\u00e7in kullan\u0131\u015fl\u0131 olabilecek apt-get,curl gibi ara\u00e7lar atak y\u00fczeyini geni\u015fletti\u011fi i\u00e7in son imaj i\u00e7erisinden silinmelilerdir.<\/li><li>Container security tool\u2019lar\u0131 ayr\u0131ca uygulamalar\u0131 ve bunlar\u0131 \u00e7al\u0131\u015ft\u0131racak yetkili kullan\u0131c\u0131lar\u0131 da kontrol ediyor olmal\u0131d\u0131r. BUnlar\u0131 organizasyon security policy\u2019lerine ba\u011fl\u0131 kalarak yap\u0131lacak compliance taramalar\u0131 ile handle etmelidir.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>\u00d6zellik\/Fonsiyon<\/td><td>Neden Gerekli?<\/td><\/tr><tr><td>IMAGE ASSESSMENT<\/td><td><\/td><\/tr><tr><td>Problemlerin saptanmas\u0131nda imaj konfig\u00fcrasyonu ayarlar\u0131 analiz edilir. Bu ayarlar build i\u015fleminde kullan\u0131lan Dockerfile y\u00f6nergeleriniuser identity konfig\u00fcrasyonlar\u0131n\u0131 ve environment variable\u2019lar\u0131 i\u00e7erir.<\/td><td>Bu a\u015fama paketler i\u00e7erisindeki bilinen zaafiyetlerin belirlenmesini sa\u011flar. \u00d6zetle zaafiyetlerin belirlenmesinde her hangi bir scanner\u2019\u0131n ka\u00e7\u0131rd\u0131\u011f\u0131 bir durumu saptayan ek bir g\u00fcvenlik katman\u0131d\u0131r.<\/td><\/tr><tr><td>Imaj bile\u015fenlerindeki zaafiyetlerin belirlenmesi<\/td><td>Zaafiyet i\u00e7eren versiyonlara sahip imaj bile\u015fenlerini kullanmak olduk\u00e7a risklidir. Bu zaafiyetleri build a\u015famas\u0131nda saptamak risklerin production ortam\u0131na ta\u015f\u0131nmas\u0131n\u0131 engeller.<\/td><\/tr><tr><td>Registry\u2019ler i\u00e7ersinde builtin bulunan scannerlardan datalar\u0131n al\u0131nmas\u0131<\/td><td>E\u011fer repository ile b\u00f6yle bir scanner \u00f6zelli\u011fi geliyorsa mevcut container security tool\u2019unun mevcut scanner\u2019dan data alabiliyor olmas\u0131 gerekir. B\u00f6ylece mevcut security context\u2019i hakk\u0131nda container security tool\u2019u aware olur.<\/td><\/tr><tr><td>Belirli bile\u015fen ve imaj katmanlara zaafiyetleri ve konfig\u00fcrasyon problemlerinin ba\u011flamak<\/td><td>Base imaj katmanlar\u0131ndaki zaafiyet ve di\u011fer problemler genellikle farkl\u0131 tak\u0131mlara ait olabilir. Bu sebeple zaafiyetlerin hangi imaj katman\u0131na ba\u011fl\u0131 oldu\u011funu belirlemek \u00f6nemlidir.<\/td><\/tr><tr><td>Hem fixable hemde gelecek aletlerden ka\u00e7\u0131nmak i\u00e7in fixable olmayan zafiyetlerin belirlenmesi<\/td><td>Bazen OS distributor\u2019lar yada opensource maintainer\u2019lar bir zaafiyeti asses edebilir fakat bunu d\u00fczeltmek i\u00e7in bir fix yay\u0131nlamayabilirler. Bu y\u00fczden development teamin workflow\u2019lar\u0131n\u0131 bu sebepten \u00f6t\u00fcr\u00fc durdurmak \u00fcretkenli\u011fi etkiler.<\/td><\/tr><tr><td>RESPONSE<\/td><td><\/td><\/tr><tr><td>CI building fail edilmesi<\/td><td>Build\u2019in belli bir zaafiyetten \u00f6t\u00fcr\u00fc fail &nbsp;edilmesi developer\u2019lara h\u0131zl\u0131 \u015fekilde aksiyon alma f\u0131rsat\u0131 verir.<\/td><\/tr><tr><td>Ko\u015ful \u00fczerinde customize edilmi\u015f kontrollere izin verme<\/td><td>Agresif kontroller development tak\u0131mlar\u0131n\u0131n security kontrollerini disable etmesine sebep olabilir. Genelde \u00e7ok s\u0131k\u0131 ve realistic olmayan kontroller bu tarz sonu\u00e7lara sebep olur.<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Enterprise seviyede container stratejisi belirlenirken en \u00f6nce d\u00fc\u015f\u00fcn\u00fclmesi gereken \u015fey g\u00fcvenlik olmal\u0131d\u0131r. Ba\u015far\u0131l\u0131 bir container g\u00fcvenlik stratejisi container\u2019\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn \u00fc\u00e7 ana bile\u015feni olan Build, Deploy ve Run a\u015famalar\u0131n\u0131n her birine entegre olmal\u0131d\u0131r. Build Deploy Run T\u00fcm bunlar\u0131n yan\u0131nda \u00f6nemli olan bir di\u011fer durum ise container\u2019\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn yan\u0131nda container\u2019lar\u0131 \u00fczerinde \u00e7al\u0131\u015ft\u0131ran alt yap\u0131n\u0131n da\u2026 <span class=\"read-more\"><a href=\"https:\/\/blog.firatyasar.com\/?p=45\">Read More &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/45"}],"collection":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=45"}],"version-history":[{"count":1,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/45\/revisions"}],"predecessor-version":[{"id":46,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/45\/revisions\/46"}],"wp:attachment":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=45"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=45"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=45"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}