Microsoft Defender for Containers

As explained in Azure Security

Microsoft Defender for Containers is Microsoft's cloud security service for detecting threats, assessing vulnerabilities, and enforcing security policies across containerized workloads and Kubernetes environments.

Microsoft Defender for Containers provides unified protection for containerized workloads and Kubernetes environments, where short-lived containers, immutable images, exposed applications, and overpermissioned roles create distinct security risks. section 7.2.2

Exposed Kubeflow dashboard

An internet-facing Kubeflow dashboard can allow unauthenticated access. Attackers may exploit its highly privileged container, reach the cluster control plane, deploy cryptomining images, and increase Azure consumption. Defense therefore spans the container registry, cluster control plane, and worker nodes. section 7.2.2

The plan combines three container-security capabilities:

• Run-time threat detection for nodes and clusters. section 7.2.2
• Vulnerability assessment for container images. section 7.2.2
• Hardening and Kubernetes policy. section 7.2.2

Enable the Containers plan at the Azure subscription level with Azure CLI: az security pricing create -n Containers --tier 'standard'. The resulting pricing resource reports a Standard pricing tier. section 7.2.2 section 7.2

Figure 7.3 An example of an attack targeting Kubernetes clusters through an exposed Kubeflow dashboard

Trace how an exposed Kubeflow dashboard can lead from unauthenticated access to control-plane compromise and malicious container deployment. section 7.2.2

How Azure Security covers it

How deep it goes

Defines three capabilities and demonstrates subscription-level activation, but defers detailed runtime detection, assessment, and policy procedures.

Examples

Uses an exposed Kubeflow dashboard, privileged container, compromised control plane, and cryptomining images as an attack chain.

What you can do after

Operate/configure it by enabling the Containers plan with Azure CLI at subscription scope.

How it connects

Connects container security with Kubernetes, container registries, Azure subscriptions, Defender for Cloud, and cloud workload protection.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• vulnerability scanninghas part · Vulnerability scanning is the automated or systematic examination of software, systems, or configurations to identify known security weaknesses.
• Azure Policy add-on for Kubernetesuses · The Azure Policy add-on for Kubernetes is a Kubernetes integration that evaluates workloads against Azure Policy rules and can audit or enforce them.
• Defender profileuses · The Defender profile is a Microsoft-developed Kubernetes agent deployed on cluster nodes to collect security signals for Microsoft Defender for Containers.
• threat detectionhas part · Threat detection is the identification of activity or conditions that may indicate a security threat, attack, or compromise.
• Microsoft Defender for Cloudkind of · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.