White Paper

WHITE PAPER Extending Mission Grade Protection to Containerized Workloads mrcy.com 2 mrcy.com 2 WHY CONTAINERS? In today 's rapidly evolving software development landscape, agility and efficiency are critical mission requirements. Containerization technologies have become essential tools for meeting these demands. Containers provide a consistent, reproducible environment for applications across any infrastructure. Developers package applications and all dependencies into a single container image, ensuring identical behavior from development through production deployment. For the A&D community, this consistency translates directly into reduced operational risk, fewer deployment failures, and increased confidence in mission-critical systems. Containers are also lightweight and share the host operating system's kernel, making them significantly more efficient than traditional virtual machines. Organizations can run dozens or even hundreds of containers on a single server without the resource overhead of hypervisor-based virtualization. This efficiency delivers substantial cost savings, with fewer physical resources required to achieve equivalent application isolation, redundancy, and scale. CONTAINER THREAT MODEL While container workloads provide isolation from both the host and other co-resident containers, an improvement over conventional native software runtimes, this isolation offers only limited security value. Because containers share a common host OS, kernel, and runtime software stack, adversaries benefit from a unified attack surface. A single vulnerability in these shared components can enable container breakouts, host compromise, and lateral movement – allowing attackers to pivot from one compromised container to exploit the host and subsequently all other co-resident containers. Containers also present unique security challenges due to how image contents are stored, shared, and distributed through image registries. While mutual authentication with an image registry is achievable, authenticating the actual image and layer contents proves far more difficult – especially when using shared or public registries. Additionally, enforcing security policies within container boundaries remains challenging, whether by isolating individual applications or restricting access to sensitive data, mounted volumes, or IPC interfaces. PROTECTING CONTAINER WORKLOADS Host Protection Step one of addressing the container threat model is securing and reducing the attack surface of the container host. RelianceOne™ enables users to define collections of critical applications, services, and data within protected directories called vaults. These vaults are isolated from other system software through a combination of OS / kernel-enforced Mandatory Access Control (MAC) policies and stacked filesystems (FortiFS and AuthFS) that provide transparent encryption, authentication, and integrity guarantees. The RelianceOne™ security suite from Mercury Systems is the leading software-based technology protection solution in the U.S. Aerospace and Defense (A&D) market. Integrated across multiple layers of the software stack, it delivers robust cyber resiliency, safeguarding the integrity and confidentiality of critical software and data. The RelianceOne suite encompasses a comprehensive range of solutions, including secure boot, Linux OS / kernel hardening, data protection for both at-rest and runtime, secure KVM-based virtualization, and support for containerized workloads. The suite's containerized workload support extends its advanced protection capabilities to address the unique security challenges and deployment models of Linux containers. This feature allows customers to deploy containerized software while adhering to U.S. government security standards and protecting critical software and data, without compromising the inherent benefits of containerization.

• Cover