Three-fifths (60%) of US organizations have experienced security incidents related to their use of containers over the past year, according to new research from Tripwire.
The vendor polled over 300 IT security professionals who manage these environments at firms of over 100 employees to better understand the challenges associated with deployment of the lightweight software packages.
The figure for security incidents jumps to 75% for respondents with more than 100 containers in production.
Worryingly, the report also found that of the vast majority (86%) of respondents with containers currently in production, 47% had deployed images containing known vulnerabilities, while a similar number (46%) didn’t know if the containers were affected by flaws or not.
Most (98%) said they need additional security capabilities to help them. Areas where security concerns are greatest include a lack of in-house expertise, limited visibility into the status of deployments and an inability to assess risk prior to deployment, the poll found.
Popularized by vendors like Docker, containers are increasingly favored by developers as they provide a more portable, efficient alternative to virtual machines. They are particularly good at ensuring software works across hybrid cloud environments.
However, organizations are being held back by security concerns: 42% of respondents to the Tripwire research claimed they had delayed or limited adoption due to cyber risk.
The firm’s vice president of product management and strategy, Tim Erlin, claimed the findings were “concerning, but not surprising.”
“With the increased growth and adoption of containers, organizations are feeling the pressure to speed their deployment,” he added. “To keep up with the demand, teams are accepting risks by not securing containers. Based on what this study found, we can see that the result is a majority of organizations experiencing container security incidents.”
Just last month, a critical vulnerability was found in popular container orchestration platform Kubernetes which could allow hackers to remotely control targeted systems.