Cloud Native Computing Foundation Cloud Native Security Conference North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Keynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native S... Kirsten Newcomer

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Keynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native Security- Kirsten Newcomer, Director Cloud Security, Red Hat

In recent years, the cloud-native community has successfully built a shared understanding of what is needed to effectively secure cloud-native infrastructure and applications. Contributions from SIGs, working groups, individuals, and CNCF members to key initiatives such as the Kubernetes security audit, industry benchmarks, and open source projects provide a foundation for tackling the various layers of cloud-native security, including approaches such as “shift left.” At the same time, the work required to adopt “best practices” and create alignment across teams can seem daunting for even the most seasoned security and DevOps teams. This session aims to help the audience get a better sense of the state of cloud-native security today. It will highlight the latest developments in Kubernetes and container security as well as where organizations have been more and less successful in adjusting security practices to be cloud-native. It will also share results from a recent industry survey on Kubernetes security, some of the biggest open questions for the community, and where we can expect to go from here.

A

So how many of you here are familiar with.

A

You know I hate switching tools too I've gotten so used to uh google slides- and here I am in powerpoint, so how many of you have heard of magic eye illusions: only f, yeah, fair amount, fair amount, so magic eye is actually a company, and this is a trademarked thing so, but it turns out there's a free tool that you can use to build these for yourself.

A

So I used this free tool to create this particular illusion right. So there's images there's an image hidden behind this now. I also learned that it's actually really hard to see these on a computer screen. So if I'd learned that soon enough, I would have printed out versions for everybody to try and use yourself. But you know when the slides are posted. If you feel like it, you can print um and take a look.

A

It also turns out that not everybody is able to actually see the images that are in a magic eye illusion, and that's because not everybody's eyes, work well together and to see everything. It's kind of a stereogram to see this. You really need to have your eyes work well together and to have them work well with the brain, and I think of this as being really apropos for how we need to work together to deliver cloud native security right. So we have to think from the security perspective.

A

That's really important, and it is absolutely true that not all developers understand that and we have to think about it from the app developer perspective and the business needs as well, and it's a balancing act. It's a risk management act to figure out. How do I meet the business needs which include a good security posture, while also enabling the app dev team to do what they need to do and to deliver quickly?

A

So also, there's this ever expanding guidance that is coming at all of us. You know: nist, 800, 190, that's been out there for a while cncf open source to kubernetes security. Audit in 2019, awesome, really great content and there's another one in progress right that I hope we'll see in 2022..

A

There's guidance from analysts like gartner right. We need to think differently about how we protect cloud workloads, especially since they're ephemeral, and they move around, as was noted right, we're not we're not dealing with ip addresses.

A

There's the new executive order, which has created this intense focus on the need to create software bill of material and the way to create um and and to improve security in your supply chain. Again, some great talks yesterday, if you didn't get to the supply chain, security, con watch the recordings and then, of course, the nsa sisa guidance for hardening kubernetes.

A

Honestly, it overlaps a good bit with the cis kubernetes hardening guide, that's great, but it's a lot for everybody to absorb and when you kind of look at this and put it all together, I do think that the guidance really comes down to the need for a devsecops approach to securing both the platform and the workloads that run on the platform right. We need to control application security in the ci cd process.

A

We need to protect the platform at deploy time. The platform ensuring that it's configured correctly kubernetes is complex, also ensuring that you've got protections in place to check workloads as they're deployed, and then we know that we can't avoid every there are unknown threats.

A

So we do need that visibility that observability that we just heard about earlier to help us detect and respond to runtime threats and part of that response. One of the things I see kind of when I talk to people about devsecops, I see a lot of emphasis on shift left, which is important, but I think of that as devsec right. A lot of that focus is how do I integrate security tools into my ci cd pipeline?

A

There's sort of this assumption that secops right, we kind of know what we're doing, and yet it's really true that kubernetes and declare the declarative environment. The fact that containers are ephemeral. Even if it's a long-lived workload.

A

Sorry you can um that that, where that pod is deployed, can change right, so you can never fix a running container. You need to rebuild and redeploy which really means that we have to think through. How do we close that devsecop loops? How do we feed that information back to the development team.

A

So red hat has done this survey on contain on the state of kubernetes security and one of the things we hear and I've also actually seen it in survey results from idc. A lot of people say that they are doing devsecops, that they have strong debt secops adoption.

A

Now I think that that's true for folks who are more on the bleeding edge, and I think that enterprises who are still in their cloud adoption journey, may think they're doing devsecops, but they're really just kind of doing that shift left. I've got vulnerability scanning in my ci process and that's about the extent of it.

A

So I think you know one of the things we really have to think about is: how can we, as a community, help organizations demystify what they need to do, but also help and and operationalize their use of cloud-native workloads, but also kind of we're all here, looking at a lot of different capabilities, a lot of new tools and things that we can do to address these key requirements?

A

But that comes with its own set of complexity right, so we need to be thinking about not just technology and tools. We need to be thinking about processing people as well. So how do we help ensure that that process is agile? And how do we help the companies that we support future proof? What they're doing think about solutions that can apply? No matter where somebody is running kubernetes or their container workloads or their cloud workloads right? A cloud can be on premises as well as in public cloud providers, so technology people process.

A

All of these remain key, and it's important that we think about the people in the process as much as the technology, so some of the future investments again. I love this that this community is investing uh in many many different ways right when it comes to application integrity and that ci cd process, the sig store project, has just kind of exploded.

A

How many of you are familiar with sig store right, so one of the things I love about sig store is how it makes it simpler for the a tool chain to sign artifacts, as the artifacts are moving through the tool chain, most signing solutions that enterprises are used to using aren't designed to be work to to be used in a pipeline.

A

It also includes a transparency, signature log right, the recourse so that you can check and make sure that and verify your signature, tech on cd chains again, another way to kind of document and log how things have gone through the process.

A

Encrypted containers, storing and running encrypted containers adds to uh the ability to manage application, security and then rootless builds right. There are many. There are some build solutions that require you to have privileges to build that container image be much better. If you didn't need to do that, especially if you're running your builds on kubernetes integrity integrity for the platform, how do I attest the host the nodes in my cube cluster?

A

How do I uh invest in things like kubernetes support for user namespaces? This is something that you know. We've been talking about for a while, it hasn't been delivered yet, and you know, there's still conversations ongoing about the complexity required there, but most of the customers. I talk to are looking for that additional protection because it's really hard, especially in certain verticals, as they move workloads to the cloud.

A

Some of them need privileges. This this they aren't able to re-architect everything to be truly micro-service based or cloud-native, and so in particular in telco.

A

Is you see, containerized native network functions delivered those often require the ability to for a certain level of privilege that is better protected with user name spaces and then also honestly, one of the biggest attack vectors for any kube cluster is the cluster admin privs, and this is a place where we don't yet have genuine separation between the control plane and the data plane, and this is an area that red hat's investing in and I I would love to see the community invest in as well with the runtime again deep observability, as was mentioned earlier, absolutely key, and the ability to use that data.

A

That's collected to automate response to what you discover, not just network policy, which is a great thing to help automate. It confuses uh our network security teams. How do they get visibility? How do they understand? Also automated response to vulnerabilities in the runtime environment and a better risk assessment right? Are those vulnerabilities in pods that are actually exposed to the network or not what's my level of risk so that I can really kind of triage those things better and then so, active recommendations really key and and again just that ability to respond.

A

um We look to the community to help deliver on all of these things again lots of great work happening, and I think one of our big challenges is going to be. How do we help our customers? Our end users, operationalize everything that we talk about everything that we're working on have them work together as a as a whole solution, and how do we help them bridge the silos that still exist between the different teams, security, ops, app dev right? That's that's a people thing that I think we should be thinking about as well.

A

So that's it for me. Thank you very much and um not sure what whether we have time for questions or somebody's up next.