News

Java Security Containers in the Microsoft Cloud

• By John K. Waters
• November 4, 2014

Microsoft has added a new security tool to its Azure Marketplace designed to allow Java developers deploying their apps on the Azure cloud platform to "BYOS" -- Bring Your Own Security. Waratek Locker, unveiled this week at the Microsoft TechEd Europe conference in Barcelona, is a containerized Runtime Application Self-Protection (RASP) product that provides security monitoring, policy enforcement, and attack blocking from within the Java Virtual Machine (JVM).

Analyst firm Gartner has defined RASP as "a security technology built in or linked to an application or app runtime environment, and capable of controlling app execution and detecting and preventing real-time attacks."

The Dublin-based Waratek, which specializes in Java security, is billing Locker as an all-in-one, Microsoft Azure Certified solution that combines the Apache Tomcat  app server (version 7) with Waratek's Application Security for Javah product. The company coined "BYOS" to describe what the RASP solution provides.

"We did come up with that," Brian Maccaba, CEO of Waratek, told ADTmag. "There was BYOB, then BYOD. The idea is, you're on the cloud, but you're still controlling your own security."

The Locker virtualized container lives inside the JVM, where it can analyze app activity at runtime, Maccaba explained. From this vantage, Locker can protect apps in the cloud from exploits that target vulnerabilities in third-party libraries and malicious activity, including SQL Injection, abnormal file manipulation, and unexpected network connections.

"Once it's in the virtual container, we are controlling all the APIs in the JIT compiler, so we have complete visibility of the data interacting with the code at the point of execution," Maccaba said.

Containerization differs from hypervisor-based virtualization in some significant ways. Containers are lightweight, in that they carry no operating system; apps within a container start up immediately, almost as fast as apps running on an OS; they are fully isolated; they consume fewer physical resources; and there's little of the performance overhead associated with virtualization—no "virtualization tax."

A rule-based engine that admins can manage remotely protects apps deployed in Azure with Locker. With this release, that engine is preconfigured with rules that restrict app access to required files, restrict app access to required network functions, and block SQL injection attacks. Waratek also offers a free Security Rules Tool  for creating custom security rules.

 Application layer security has become a hot topic, spurred recently by enterprises growing interest in the Internet of Things.

 "Perimeter security is kind of done for," Maccaba said. "It keeps the kids who want to steal your apples out of your orchard, but it doesn't stop the professionals who wants to break into your house and steal your jewelry."

 Although the Locker solution is new, Waratek has been working with the collected technologies for some time. The company chose Azure for its first branded release because of interest expressed by Microsoft.

 "Microsoft engaged with us and made it very clear that it's extremely important to them to have best-of-breed Java and Linux technologies on Azure," Maccaba said. "Which makes sense. They can only win the enterprise cloud war long term if they can prove that they've got the best non-Microsoft technologies, as well as Microsoft tech. They're making a very conscious effort, and they just sort of wrapped their arms around us."

Garth Fort, GM of Microsoft's Enterprise Partners group, commented in a statement:"Technologies like Waratek Locker, that enable security policies and controls to follow applications, make it even easier to move mission critical apps to the cloud."

Waratek is likely to release Locker for other cloud platforms in the future, Maccaba said.