1

Ive read a lot about container ( mostly docker) technology and its limitations in terms of security.

I note that MDM/MAM solutions use containers to secure enterprise data. The idea being that the enterprise data can be remotely wiped if it is held in a sandbox.

Now having read about securing Docker containers I am aware that containers are not very secure (they do not contain, for example, if all of the kernel functions are not name-spaced).
Similarly, there are steps that may be taken to harden containers against misuse.
Thus it is only right to conclude that all mobile containers are not made equal. So my question is how to assess these different container implementations if they are hidden? Some sort of black box testing is in order..... what would be a reasoned approach/tools
In the full realization that if the device itself falls into the wrong hands then all bets are off security wise. To buy into this technology you must be able to appraise the security of the container and not jut take it on trust that it is "good".

1

This is done not just with black box testing, but also full code review, white-box testing, and everything in between, and is generally provided by consultants experienced in this space. I'm not convinced there is much value in end-user organisations conducting their own testing, as you will spend a lot of time rebuilding after each time you accidentally wipe the device :-)

And you are slightly mistaken in your assumption that all bets are off if the attacker gets hold of the device. The whole point of it is that it doesn't matter if an attacker acquires the device - the security is such that the container is resistant to attack, at least to the extent that a small number of failed attempts wipes the key, leaving the container useless.

  • Thanks for getting back to me, though with respect, your response leaves the end user in the situation where they just trust that it is "good" based on the marketing, or am I mistaking you? I'm not the first person to ask how secure containers are but I am asking how do you check in a closed implementation on a mobile? introspection? fuzz testing? etc... – steveeweeveewoo Sep 25 '16 at 9:59
  • My team did this once for a large vendor of devices, and it was not easy. They didn't want to give us any code, but we had some good info on security architecture of the devices so could work with that. But 70% of the time we were just rebuilding to try variations/fuzzing/race/brute force attacks – Rory Alsop Sep 25 '16 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.