►
From YouTube: Keynote: Leave it to the Machine - How to Leverage AI to Effectively Shift Left Sec... Yuval Shchory
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: Leave it to the Machine - How to Leverage AI to Effectively Shift Left Security- Yuval Shchory, Head of Product Management, Check Point
Containerization and the empowerment of developer and DevOps teams have been one of the most productivity driving factors in today’s cloud life. Building a new n-layered application has never been so easy, and pushing from staging to production has never been so swift. But – where does this leave the security of these environments? Where does this leave the different security teams in terms of their ability to be proactive and timely responding to requirements by these newly established container-based applications?
This keynote will focus on how Machine Learning and Artificial Intelligence provides a means to “shift left” security capabilities as well shorten the time between n-layered application readiness for production and its actual production. See how by employing AI/ML, security teams will be no longer regarded as the bottle necks of the application world and will allow themselves to lead in the continuum of securing containerized application delivery.
A
A
Let
me
just
kind
of
make
sure
that
we
all
understand
what
what's
really
keeping
security
people
up
at
night
and
first,
it's
a
lot
about
visibility,
I'm
an
old
school
guy.
I
was
a
ciso
of
service
providers
back
in
the
days
where
a
pizza
box
wasn't
just
something
you
bring
pizza
in,
but
it
was
a
one-u
server
and
in
order
to
save
to
understand,
what's
happening,
you
just
needed
to
map
the
wirings
right.
You
knew
what's
connected
where
we
don't
have
this
visibility.
We
do
not
know
where
our
crown
jewels
are.
A
A
How
do
security
people
keep
still
their
values
and
you
know,
are
they
really
valuable
for
the
organization?
And
the
reason
is
that,
back
in
the
old
days,
security
peeps
were
involved
in
designing
systems,
as
they
were
just
thought
about
in
today's.
In
a
lot
of
cases,
we
see
the
devops
team
and
the
developers
team
coming
and
say
we're
ready
to
go
production.
Please
secure
this
right,
so
this
is
this
is
actually
like.
Am
I
still
valuable
for
the
organization
question
next?
A
Last
but
not
least-
and
this
is
something
that
did
not
change
ever
since
day-
one
of
information
security
is
how
do
I
keep
myself
off
the
wall
street
journal
headline?
This
is
like
the
number
one
concern:
how
hard
is
it
when
and
I'm
not
I'm
not
calling
developers,
you
know
non-knowledgeable
or,
but
they
do
not
understand
security
always
right,
and
how
do
I
make
sure
that
there
are
no
mistakes
done
on
the
left
side
because
we're
shifting
left?
How
do
I
make
sure
that
we're
not
making
mistakes
there?
A
So
the
use
of
machine
learning
in
ai
is
really
critical
in
order
to
grab
so
much
information
and
make
it
actionable
and
make
it
something
that
is
insightful
and
a
lot
of
times.
I
hear
people
say
I'm
getting
so
much
data,
but
it's
like
finding
a
million
needles
in
a
wheat
field
right.
That's
that's
one
of
the
challenges
that
we
see
today,
so
this
is
why
we
need
to
use
ai
the
more
data,
and
I'm
sure
you
know
that
the
more
data
you
feed
to
the
machine
learning
beast
the
accurate
it's
going
to
get.
A
A
Now,
let's
take
you
know
a
scene
like
a
day
in
a
lifetime
of
a
security
person
working
with
devops
and
and
developing
engineers.
First
question
is:
oh
okay,
you're
asking
me
to
secure
this
kubernetes
cluster.
What
network
traffic
is
happening
in
between
the
cluster
nodes?
What's
happening
in
between?
You
know,
east
west,
nor
north
south,
and
the
answer
is
usually
well.
A
I
don't
know
like
we
don't
have
any
policy
right
and
then
the
security
person
talk
about
the
old
world
solution
uses
the
number
one
advanced
analysis
tool
in
the
security
policy
analysis
arena
which
is
an
excel
sheet
and
let's
get
all
the
logs
into
an
excel
sheet
and
crunch
it
and
find
the
unique
connections,
and
this
is
how
I'm
going
to
build
my
my
solution.
It
does
not
scale,
it
does
not
respond
well
to
changes.
A
What
do
we
do
differently,
and
this
is
exactly
where
I
want
to
turn
into
a
small
demo
and
again,
I
just
want
to
really
show
you:
how
could
you
harness
ai
in
order
to
create
a
security
policy
model?
So
what
you
see
here,
you
know
a
very
simple,
very
traditional,
almost
three-tier.
If
we're
still
allowed
to
use
this
term
application
with
you
know
a
front
end,
an
application
set
of
capabilities
and
then
maybe
a
more
secure
system.
So
how
do
I
know
what
different
relationship
from
a
networking
perspective
do
I
need?
A
What
we
will
do
is
we'll
actually
use
a
discovery
agent
to
first
understand
what
assets
do
I
have,
which
is
also.
We
talked
about
visibility,
I
don't
know
what
service
do.
I
have
right
and
the
first
thing
and
I'm
not
going
to
go
through.
You
know
how
it's
installed
et
cetera,
et
cetera.
The
first
thing
and
discovery
agent
would
do
is
map
the
different
nodes,
the
different
pods,
the
different
services,
etc,
etc.
A
Very
limited
visibility
right
only
one
namespace,
because
nothing
still
happened,
but
once
we
turn
on
learning
mode,
we
could
actually
start
understanding
what's
happening
in
between
the
nodes
and
build
a
policy
model.
It's
not
just.
Let
me
record
this
but
really
build
a
policy
model,
and
yes,
there
are
things
that
we
could
statically.
You
know
do
from
day
one.
I
don't
want
my
my
system
to
go
to
malicious
domains
right,
but
still
I
want
machine
learning
to
actually
tell
me
what's
happening
inside
my
my
system.
A
So
once
you
turn
machine
learning
in
order
to
build
the
the
security
policy
you're
going
to
start
seeing-
and
this
is,
I
think,
the
beauty
of
machine
learning
is
going
to
grow
as
you
go,
it's
going
to
be
very
coarse
at
first
and
then
it's
going
to
and
it's
going
to
tell
us.
Listen
you're
at
high
school.
Now
you
need
to
keep
learning
until
you
get
to
a
professorship.
A
You
know
position
in
terms
of
like
I
know
everything
that's
happening
there,
but
the
more
you
go.
It's
it's
giving
you
it.
It
understands
now
like
what
name
spaces
are
being
used.
It
understands
now
the
actual
connections
and
relations
between
the
things.
Now,
maybe
it's
not
as
colorful
as
the
diagram
we
saw
at
first,
but
these
are
the
network
vectors
that
you
see
so
once
we
have
this,
we
can
also
start
looking
at
the
policy
model
that
it
suggests
and
the
suggestion
of
course
again
new
world.
A
We
can't
use
ip
addresses
as
security
policy
constructs,
but
instead
things
like
pod
names
and
resource
names
right
in
services,
et
cetera,
et
cetera.
So
what
we
saw
here
in
a
matter
of
hours
getting
from
not
knowing
nothing
about
the
network
traffic
and
knowing
exactly
what
security
policy
we
need,
and
everything
is
courtesy
of
machine
learning
that
built
really
the
model
you
you're
changing
you're,
adding
a
node
you're,
adding
a
pod.
It
will
relearn
everything,
so
you
can
always
use
machine
learning
again
and
again.
A
Let's
look
at
another
scene,
another
scene
where
someone
is
you
know,
needs
to
understand.
What's
the
permission
model
that
is
needed
right
and
you
go
to
like
devops
engineer,
developer
engineer
and
they
say:
well,
we
don't
know
it's
a
it's
a
it's
an
s3
bucket
that
is
pre-configured
by
a
third-party
tool
that
we're
using
right.
A
A
So
first
thing
that
when
you
have
in
this
case
it's
a
serverless
function
that
you
can
see
is
like
okay,
what
different
resources
do
I
use,
but
by
the
way
there
are
cases
where
engineers
don't
even
know
exactly
what's
being
used
because
it's
a
third-party
tool,
but
also
when
they
build
it.
If
they
don't
document
everything
they
just
don't
know
after
using
machine
learning,
static
code,
analysis,
etc,
we
could
understand
two
models:
the
configured
model
and
because
we're
calculating
all
the
paths
that
the
code
could
take.
A
What
is
the
required
security
model
and
it
will
tell
you
listen
your
s3
bucket
is
currently
overly
open
and
you
need
to
shut
it
down
now,
try
to
go
to
a
developer
and
tell
them
reduce
the
permissions
on
the
s3
bucket
and
they're
going
to
say.
Well
what
does
it
mean?
I
want
to
be
able
to
do
everything
I
do
right
and
the
benefit
of
using
machine
learning
in
order
to
build
a
policy
model.
Is
that
not
only
tells
you
what's
needed?
A
It
empowers
the
security
people
to
speak
the
lingo
of
devops
and
developers
in
order
to
even
give
them
a
yaml
snippet
in
order
to
configure
the
resource.
So
again,
in
a
matter
of
a
minute
and
a
half
just
running
the
the
function
once
twice
10
times
the
more
you
run
it,
the
more
accurate
you
get
you
get
from.
I
have
no
idea
what's
happening
to
a
you
know.
I
know
everything
everything
there.
A
So,
let's
summarize
remember
especially
if
you're
a
developer
or
from
the
devops
community,
the
more
data
you
send
to
the
security
guys
doesn't
mean
that
you're
giving
them
more
visibility
or
more
insights,
and
this
has
to
be
something
that
you
we
always
remember.
You
have
to
create
a
situation
where
you
have
insights.
A
The
the
second
thing
is
that
the
more
information
you
actually
feed
to
machine
learning,
unlike
a
person
that
just
need
to
read
to
read
a
you,
know,
an
audit
log,
the
more
information
you
feed,
then
the
more
accurate
your
beast
would
be.
We
live
in
a
world
where
we're
not
looking
for
a
needle
in
a
haystack.
A
We
do
not
advance
persistent
threats,
are
here
to
stay,
we're
going
to
see
them
even
more
and
we're
looking
for
million
needles
in
a
wheat
field.
It's
not
just
a
stack
right
think
about
where,
where
your
system
is
distributed
across
multiple
cloud
service
providers,
how
do
you
understand
what's
what's
happening
there
and
with
that
I'll?
Thank
you.
Thank
you
very
much.