Enhancing Cloud-Native Security: Qualys Introduces Scanning for Container-Optimized OS in Google Kubernetes Engine

As organizations move from traditional workloads to containerized environments, they encounter new security challenges. Containers bring added complexity that traditional security tools often struggle to manage, largely because of their transient nature and the shared responsibility between the container and the host operating system. This shift necessitates a fresh approach to security, as visibility into containerized applications is often limited, and vulnerabilities can quickly spread across systems. To effectively secure these dynamic environments, companies must adopt solutions that offer comprehensive visibility into both the host OS and containers, enforce robust security policies, and maintain compliance with evolving standards.

With our latest advancement, Qualys is one of the first solutions to directly scan Google Cloud’s Container-Optimized OS instances using the Qualys Cloud Agent. As Container-Optimized OS forms the bedrock of the Google Kubernetes Engine (GKE), ensuring its security is crucial for maintaining a robust and reliable containerized environment. Our groundbreaking capability enables organizations to effectively manage and mitigate risks at both the host OS and container levels. In this blog, we’ll delve into the specific security challenges posed by Container-Optimized OS in GKE and demonstrate how Qualys delivers unmatched visibility, actionable insights, and thorough security auditing to protect containerized applications in the cloud. By addressing these critical aspects of Container-Optimized OS, Qualys reinforces its commitment to safeguarding the core infrastructure that powers modern container orchestration and cloud-native applications.

Security Challenges

Securing containerized applications on Container-Optimized OS poses distinct challenges:

• Lack of Asset Visibility
  Securing assets becomes an uphill battle without a consolidated inventory detailing installed packages, open ports, users, and hardware.
• No Actionable Intelligence
  While Google provides security advisories for Container-Optimized OS, determining the impact and automating responses without the right tools is a significant challenge.
• Need for Security Auditing
  Industries with stringent regulatory requirements need repeatable processes for inventory management, vulnerability management, and reporting. Achieving this level of oversight in containerized environments can be difficult.

How Qualys Solves These Challenges

Qualys addresses these challenges through a comprehensive security solution:

• Qualys Cloud Agent (Host Scanning)
• Qualys TotalCloud CSPM (Cloud Security Posture Management)
• Qualys Container Security

Securing Container-Optimized OS within (GKE) presents distinct challenges, and Qualys delivers a robust solution through its comprehensive approach. The Qualys Cloud Agent plays a vital role in fortifying security by performing in-depth host scanning, ensuring that vulnerabilities on Container-Optimized OS instances are swiftly detected and addressed. Additionally, Qualys Container Security scans container workloads, enabling organizations to identify and mitigate security issues within their containerized environments. The Qualys TotalCloud CSPM (Cloud Security Posture Management) offers a complete view of the Google Cloud environment, empowering organizations to enforce security policies, identify misconfigurations, and maintain compliance with industry standards. Together, these Qualys solutions establish a strong security framework that protects Container-Optimized OS deployments in GKE, giving organizations the confidence to operate securely in the cloud.

Qualys Cloud Agent (Host Scanning)

The Qualys Cloud Agent for Container-Optimized OS is a lightweight, containerized agent that integrates seamlessly with the immutable nature of Container-Optimized OS. It enables comprehensive host scanning to identify and remediate vulnerabilities effectively. This agent aligns with the cloud-native architecture of Container-Optimized OS, offering organizations a purpose-built tool for enhanced security visibility and risk management.

Key Features:

• Unparalleled Visibility: Utilize Qualys Global AssetView to gain a unified view of your GKE clusters, including detailed information about nodes, configurations, and cloud provider metadata.
• Seamless Deployment: Deploy the Qualys Cloud Agent on Container-Optimized OS with ease, as it runs within a container and requires no host modifications or credential management.
• Actionable Intelligence: Benefit from automated detection and assessment of vulnerabilities using Google Cloud’s security advisories. Prioritize remediation with specific details on vulnerable packages and necessary upgrades.

• Policy Compliance with CIS Benchmarks: Qualys enhances its capabilities to include policy compliance for Google Container-Optimized OS using CIS Benchmarks. Ensure that your Container-Optimized OS deployments meet industry-standard security benchmarks, improving your containerized applications’ overall compliance and security posture.

Qualys TotalCloud CSPM (Cloud Security Posture Management)

TotalCloud CSPM offers a holistic view of your cloud infrastructure, ensuring compliance and security best practices. It provides continuous monitoring, policy enforcement, and threat detection across your Google Cloud environment.

Key Features:

• Comprehensive Cloud Visibility: Gain insights into your Google Cloud infrastructure, including Container-Optimized OS instances, to manage security effectively.
• Automated Compliance Checks: Ensure adherence to security best practices and compliance standards through automated checks and policy enforcement.
• Eliminate Misconfigurations: Seamlessly resolve configuration issues using 1-Click options or automated custom workflows.

Qualys Container Security

Secure your containerized applications from build to runtime with Qualys Container Security. This solution provides comprehensive vulnerability management, malware detection, and actionable insights for effective threat mitigation.

Key Features:

• Vulnerability Management: Detect and respond to vulnerabilities across the container lifecycle.
• Malware Detection: Use deep learning AI to identify known and unknown malware in containers.
• Actionable Insights: Prioritize vulnerabilities with detailed intelligence on impacted packages and required upgrades.

About Container-Optimized OS in Google Kubernetes Engine

GKE is a certified Kubernetes distribution and a supported container platform with robust enterprise security features. GKE enables organizations to build, deploy, run, and manage intelligent applications securely at scale within a hybrid cloud environment. It emphasizes security throughout the stack, adhering to a defense-in-depth approach to safeguard your containerized applications.

Container-Optimized OS is Google Cloud’s purpose-built, open-source operating system designed to enhance the security and efficiency of containerized applications in GKE. Container-Optimized OS is streamlined, immutable, and optimized for container workloads, making it a preferred choice for secure and scalable containerized deployments.

Key Features:

• Immutable Nature: Google Container-Optimized OS adheres to an immutable model, ensuring the operating system always boots into a known, secure state. This design complements containerized deployment methodologies, enhancing consistency and reliability.
• Transactional Updates: Container-Optimized OS supports atomic, transactional updates, which allow for smooth rollbacks if issues occur during updates. This feature improves system reliability and simplifies the maintenance process.
• Container Optimization: Container-Optimized OS is specifically engineered for container workloads, reducing its footprint and focusing on delivering the essential functionalities needed for efficient container operation.
• Security Enhancements: Container-Optimized OS includes robust security features such as SELinux, Linux namespaces, CGroups, Capabilities, and Read-Only Mounts to bolster the security of containerized applications.

Why Google Container-Optimized OS?

• Scalability: Container-Optimized OS is designed to scale effortlessly with containerized environments, making it a strong choice for applications running on GKE.
• Ease of Management: Its containerized architecture simplifies the management of container hosts, making installation, updates, and maintenance more straightforward.
• Collaboration with Qualys: Container-Optimized OS users can benefit from advanced security solutions that further enhance the protection of their containerized workloads.

In summary, the integration of Qualys security solutions with Google Cloud delivers a robust approach to securing containerized environments in GKE. By utilizing Qualys’ Cloud Agent, Container Security, and TotalCloud CSPM, organizations gain a comprehensive and proactive strategy for identifying and addressing security risks. Qualys is the first and only solution capable of scanning Container-Optimized OS with the Qualys Cloud Agent, providing unparalleled visibility and control. These advanced tools enable organizations to confidently deploy and manage containerized applications on Container-Optimized OS, benefiting from a secure, efficient, and purpose-built platform. This collaboration not only strengthens the security of container orchestration but also enhances the overall reliability and resilience of applications hosted on Google Cloud. As containerization becomes more prevalent, the Qualys and Container-Optimized OS collaboration plays a crucial role in building a secure and reliable ecosystem for modern application deployment and management.

Learn More and Get Started

Log in to your Qualys subscription to download the Cloud Agent binary, and refer to the installation guide for step-by-step instructions.

New to Qualys TotalCloud? Sign up for a trial today.

Contributors

• Will Pien, Senior Product Manager, Google Cloud