Container security gained a new vendor – and acronym – as Carbonetes launched with a hosted container application security testing (CAST) service that it claims trumps established players by offering a complete package of components. 

Carbonetes CEO and Founder Mike Hogan said that current container-focused security products all fall short in terms of offering a complete one-stop shop for customers. “The existing container security solutions require assembly of disparate expensive tools to analyze your containers across a spectrum of threats," he said.

Specifically, Hogan explained that Snyk, which he said was the leader in providing analysis of open source components – software composition analysis (SCA) such as vulnerabilities, licensing, and dependencies – has no policy service. WhiteSource, which covers the SCA and the policy, doesn't have anything for native code. And Anchore, which only runs on-premises and covers native code and policy, did not cover SDN. Hogan boasted that Carbonetes is the “sweet spot in the middle.” 

“We recognized there was no comprehensive solution and therefore an opportunity for us to provide that,” he added. “Folks that we compete with specialize products ... whereas we're the only ones that cover everything, providing the malware and the comprehensive capability multi-scanning that runs in the cloud.” 

Carbonetes' CAST offering analyzes all aspects of a container’s contents. Hogan said his company focuses on complete analysis with a “hey we do it all,” attitude. 

A software composition analyzer monitors open source tools for dependencies and vulnerabilities. A license analyzer creates a list of licenses associated with each open source tool in the container. A configuration analyzer identifies configuration risks, such as privilege, root access, scaling constraints, and memory utilization. 

It also has a secrets analyzer that identifies sensitive data in the container that could be compromised, such as passwords and credentials. The multi-engine vulnerability analyzer detects vulnerabilities with threat levels, common vulnerabilities and exposures details, location in the code, and suggested fixes. The malware analyzer offers protection from trojans, viruses, and malware in containers.

The cloud-native ecosystem continues to blossom as enterprises increasingly look toward taking greater advantage of their cloud infrastructure to speed up their internal operations and support for external services. However, that bloom has been impacted by the cloud of security concerns tied to nascent cloud-native technologies.

The Cloud Native Computing Foundation (CNCF) recently released its 2019 community survey that found security was the second biggest challenge faced by organizations in deploying containers. Forty percent of those surveyed cited that challenge, which came in just behind cultural changes they see with their development teams.

“Many of the tools they have been using for years — those that were designed to ensure security and performance of monolithic applications running on a relatively simple, vertical stack — no longer suffice in complex environments that are increasingly composed of containers, microservices, third-party services, and multiple clouds,” noted 451 Research in an enterprise report on cloud-native security. “The trade-off for agility gains is sheer complexity: the scale in the number of components that can be tracked for what is essentially similar functionality can jump one or two orders of magnitude.”