Terminology Index

Glossary

2953 terms

Container Artifact Provenance

Container artifact provenance links an immutable image digest to source, build definition, external inputs, builder, output, attestations, and signing identity.

Container Artifact Trust

Container artifact trust links an immutable digest to source, build, dependencies, builder, inventory, provenance, signature, tests, registry, promotion, and deployment policy.

Container Cluster Assessment

Evaluating the security of a container orchestration cluster (such as Kubernetes) during a cloud assessment, checking API server exposure, RBAC, network policies, pod security, and admission controls for weaknesses.

Container Compliance

Ensuring container images and running containers meet security and configuration standards, scanned for vulnerabilities, built from approved bases, signed, and configured to benchmarks, so they satisfy both internal policy and external requirements.

Container Detection Patterns

The behavioral signals that indicate an attack on or within containers, such as a container spawning an unexpected shell, attempting to escape to the host, or making anomalous network connections, used to detect threats at runtime.

Container Escape Patterns

The techniques attackers use to break out of a container's isolation and reach the host or other containers, such as exploiting an over-privileged container, a kernel vulnerability, or a misconfigured mount. Escape turns a contained compromise into a broader one.

Containers share the host kernel, so their isolation can be defeated: a container running as privileged or with risky capabilities, a mounted host path, or a kernel exploit can let an attacker escape onto the node and from there to other workloads. Understanding these patterns drives the defenses, dropping privileges and capabilities, restricting mounts, hardening the host and kernel, and detecting escape attempts at runtime, that keep a container compromise contained.

Introduced in: Cloud-Native Security

Examples

Abusing a privileged container to access the host node.
Exploiting a kernel vulnerability from inside a container to escape.
Using a misconfigured host path mount to reach the underlying host.

Container Image Scanningrelates_to Container Registry Securityrelates_to Cloud-Native Attack Patternsrelates_to Container Detection Patternsrelates_to Container Hardeningrelates_to Kubernetes-Specific Attacksrelates_to Cloud-Native Incident Patternsrelates_to Compromised IAM Credentials Playbookrelates_to Conditional Access (Cloud)relates_to Configuration Assessmentrelates_to Configuration Evidencerelates_to Container Compliancerelates_to Container Detection Patternsrelates_to Cloud-Native Attack Patternsrelates_to Cloud-Native Incident Patternsrelates_to Container Hardeningrelates_to Container Runtime Protectionrelates_to Containerization Patternsrelates_to Cryptojackingrelates_to

Container Evidence Preservation

Container evidence preservation captures workload specification, immutable digest, runtime and node identifiers, available process and network state, writable data, logs, identity use, and orchestration history before ephemeral state disappears.

Container Hardening

Reducing a container's attack surface by building minimal images, running as non-root, dropping unnecessary capabilities, making filesystems read-only, and removing unneeded tools, so a compromised container offers an attacker little to work with.

Container Image Scanning

Within DevSecOps, scanning container images in the pipeline for known vulnerabilities, exposed secrets, and insecure configurations before they are deployed, so security issues are caught and fixed early in the software lifecycle.

Container Images

The packaged, immutable templates that define what runs in a container, bundling an application with its dependencies and configuration. Images are built in layers and run as containers, making their security foundational to container security.

Container Orchestration Security Assessment

Container orchestration security assessment reviews cluster exposure, identity, RBAC, admission, Pod Security Standards, workload identity, secrets, network policy, audit, upgrades, nodes, add-ons, namespaces, and workload contexts.

Container Registries

The repositories that store and distribute container images, public or private, from which images are pulled to run. Because they are the source of what gets deployed, their security and integrity are critical to the software supply chain.

Container Registry Security

Protecting the container registry through access control, image signing and verification, vulnerability scanning of stored images, and provenance checks, so only trusted, clean images can be stored and deployed.

Container Runtime Baseline

A container runtime baseline describes expected processes, executable paths, file changes, network destinations, identities, capabilities, mounts, syscalls, and administrative actions for a workload.

Container Runtime Protection

Securing containers while they are running by monitoring their behavior and blocking malicious activity in real time, such as detecting and stopping a container escape, unexpected process execution, or anomalous network connection.

Container Runtime Security

Securing running containers as practiced by a cloud security engineer, applying runtime monitoring, detection, and response to containerized workloads as part of operating cloud security, alongside build-time and platform controls.

Container Security

The discipline of securing containers across their whole life, from building and scanning images, through hardening and signing, to runtime protection and orchestration security, so containerized workloads resist compromise and isolation holds.

Container Security Lifecycle

The stages of securing a container over its life, build (hardened, scanned, signed images), ship (secure registry), and run (admission control and runtime protection), with security applied at each stage rather than only at the end.

Container Security Model

Within DevSecOps, the conceptual model for how container security is layered, image, build, registry, runtime, and orchestration, that guides where to place controls in a secure software delivery pipeline.

Container Vulnerability Scanning

Scanning container images and running containers for known software vulnerabilities, identifying vulnerable packages in image layers so they can be fixed before deployment and tracked while running.

Containerization Patterns

Common ways of structuring and deploying containers, such as one process per container, sidecar and ambassador patterns, and init containers, each with security implications for isolation, privilege, and the attack surface.

Containment

Actions taken to limit the spread or impact of an incident.

Containment Actions

The steps responders take to stop an incident from spreading or causing further harm, such as isolating a host, disabling an account, blocking a network connection, or revoking credentials, while preserving evidence for investigation.

Containment Exit Criteria

Containment exit criteria define the evidence required before the incident authority treats safeguards as stable enough to progress toward eradication and recovery.

Containment Objective

A containment objective states the harmful capability to interrupt, affected entities, expected proof of success, responsible owner, duration, rollback, and known residual paths.

Containment Risk

The downside of a containment action, such as disrupting legitimate business, tipping off the attacker, or destroying evidence, that responders must weigh against the benefit of stopping the threat.

Containment Strategy Tradeoff

A containment strategy tradeoff compares expected harm reduction, speed, evidence preservation, attacker reaction, scope, safety, availability, dependencies, reversibility, and authority.

Containment Tradeoff Analysis

Containment tradeoff analysis compares urgency, reversibility, evidence loss, service and safety impact, adversary warning, dependencies, scope confidence, and alternative actions.

Containment Validation

Confirming that containment actually worked, that the attacker's access is cut off, the threat cannot spread, and no overlooked foothold remains, rather than assuming an action succeeded.

Containment Verification

Containment verification confirms that an action reached the intended population, took effect, interrupted the target behavior, remained enforced, and did not create unacceptable harm.

Content Security Policy

A browser security policy that limits where scripts, images, styles, and other resources can load from.

Context Gathering

Collecting the surrounding information an analyst needs to make sense of an alert, the user, host, asset criticality, recent activity, and related events, so triage decisions rest on a full picture rather than the alert alone.