Automating Cyber-Hardening for Docker Containers

This proposal addresses Focus Area 1: Air Force Cyber Systems and Process, securing and hardening software containers. The problem is that many of the most damaging cyberattacks exploit memory corruption vulnerabilities (e.g. heap overflow, stack overflow). Even with code scanning, memory corruption vulnerabilities in software persist. In its September report “Top 25 Most Dangerous Software Errors”, MITRE identified the highest-ranking weakness as CWE-119, buffer overflow. In response to these pervasive and often exploited memory corruption vulnerabilities, RunSafe Security launched Alkemist in 2018, an automated software transformation tool that hardens code from these types of attacks via a moving-target-defense approach. Rather than hunt down obscure, hard to find bugs, Alkemist removes the underlying construct in software that makes these attacks viable. Our tool is TRL 8 in the commercial market, with implementations and trials on-going with Vertiv, Avocent, Bosch, Samsung and Qualcomm. Our tool is TRL 6 in the DoD market, with initial implementations with NAVWAR and NAVAIR. In this Phase 1, RunSafe investigates: (1) the feasibility of automatically applying Alkemist to cyber-harden Docker images within Air Force CI/CD pipelines and (2) the impacts hardening has on metrics such as build time, load time, and memory overhead.