Day 7: Container Security 5 Expert Tips |

Welcome to Day 7 of Cybersecurity Awareness Month 2023! Today, we're delving deeper into container security with 5 essential tips. From minimizing dependencies to secrets management, learn how to fortify your containers.
Get hands-on experience with AppSecEngineer Container Security courses. Strengthen your skills and ensure a more secure environment for your applications!
Container Security Learning Path: www.appsecengi...
AppSecEngineer For Businesses: www.appsecengi...
AppSecEngineer For Individuals: www.appsecengi...
#SecureOurWorld #cybersecurity #CybersecurityTraining #appsec #applicationsecurity #infosec #Security #securitytraining #training #handsonlearning #StaySafeOnline #containersecurity #kubernetes #docker

[@senthilkumar-rr2mj]

Bro, if I use environment variables, once the attacker gets RCE, they will possibly access environment variables. So is it best practices?

[@AppSecEngineer]

It’s very difficult to not use env-vars itself. The key is to ideally use env-vars sparingly. For example, you’ll have to probably configure a secrets management solution to handle app secrets, but the secret to access the secrets management solution will probably need to be an env-var. however, this is still lower risk because one can secure the secrets management solution with access control, audit trails etc Env-vars do have an inherent risk, but reducing the blast radius of the secret in the env-var is more important

[@AppSecEngineer]

Besides, rce will generally mean that the app env is completely compromised. Even if you had that secret in a config file, it would still be pwned