►
From YouTube: Keynote: CloudNativeDevSecOps - Hillel Solow, Cloud Innovation Architect, Check Point Cloud
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: CloudNativeDevSecOps - Hillel Solow, Cloud Innovation Architect, Check Point Cloud
It’s high time developers took responsibility for securing their applications, wherever they run, but Cloud Native applications provide both unique challenges and opportunities to make this transition. In this talk, we will discuss some of the ways that developers can lean in and make a huge impact on application security in the cloud.
A
Hey
everybody
welcome
to
cloud
native
security
days,
presentation
from
checkpoint.
My
name
is
hill
solo
from
checkpoint
security,
and
what
I
want
to
talk
to
you
today
about
is
what
we
call
cloud
native
devsecops,
which
is
a
long
word
which
I'll
try
to
explain
in
a
minute,
but
first
a
little
background
about
myself
and
about
checkpoint.
My
name
is
hillel
solo.
A
As
I
said,
I'm
the
cloud
innovation
architect
at
checkpoint
c
cloud,
cto
office,
I've
been
in
checkpoint
for
about
a
year
and
a
half,
and
it
came
there
by
way
of
an
acquisition.
The
checkpoint
made
up
a
company
that
I
was
one
of
the
co-founders
of
called
protego
and
we
were
focused
in
protego
on
cloud
workload
security.
A
And
since
then,
we've
been
part
of
the
cloudguard
organization
at
checkpoint
really
trying
to
drive
forward
how
checkpoint
helps
customers
solve
cloud
security,
challenges
and
cloudguard
is
a
big
suite
of
products
from
checkpoint
that
deals
with
everything
from
cloud
posture,
workload,
security,
analyzing,
logs
and
and
looking
for
anomalies
and
so
on
and
so
forth,
and
our
serverless
piece
is
now
part
of
that
environment.
So
I've
been
in
checkpoint
for
about
18
months.
A
A
So
what
I
want
to
cover
today
in
a
really
short
time
slot,
and
so
I
apologize
for
how
quickly
I'll
speak
is
first
of
all
what
what
is
devsecops.
Why
devsecops?
Why
is
it
my
problem
as
developer
and
I'm
really
primarily
talking
to
you
developers
out
there
and
trying
to
convince
you
that
security
is
your
problem?
It's
not
someone
else's
problem,
so
why
is
devsecops
a
thing?
What
do
we
mean
by
that,
and
then
why
do
I
claim
the
cloud
native
devsecops
is
a
different
thing
or
an
evolution
of
that
thing?
A
What's
different
about
it
and
then
finally,
try
to
give
you
some
tools
and
tips
and
technologies
to
how
you
can
try
to
solve
that
problem
and
own
it
so
focusing
on
what
devsecops
is
to
me.
Devsecops
is
it's
the
philosophy
that,
as
a
developer,
I
own
security.
Just
like
I
own
any
other
feature
of
my
product.
Security
is
just
another
important
product
feature,
making
sure
that
my
product
works
securely.
A
It's
just
as
important
as
making
sure
my
product
works
at
scale
or
any
of
the
other
non-functional
requirements
we
tend
to
think
of
when
we
think
of
a
product
and
the
idea
that
till
now
security
was
something
else
that
was
someone
else's
problem
is
kind
of
a
silly
thought.
Really.
It
doesn't
really
work
all
that
well
and
particularly
as
we
move
into
more
modern
applications,
it's
really
challenging
to
stick
with
that
paradigm.
So
devsecops,
and
really
I'd
like
to
just
call
it
devops.
A
To
be
honest,
is
just
saying:
security
is
yet
another
part
of
the
functional
and
non-functional
requirements
for
our
application.
That
means
that
we,
as
developers
are
responsible
for
deploying
and
operating
secure
applications
right
once
once
you
own
that,
once
you
say,
okay,
it's
me:
it's
not
somebody
else's
problem,
I'm
not
helping
them!
It's!
My
problem,
maybe
they're
helping
me
well
that
changes
a
lot
about
what
you
feel
like
you
have
to
solve
right,
so
security
teams
are
still
there
they're
still
there
to
help.
A
It's
part
of
your
application
and
you're
responsible
for
it,
and
what
that
means
is
things
like
making
sure
that
you
do
code
scanning
to
look
for
mistakes,
that
your
developers
are
making
and
things
like
that
and
make
sure
make
sure
your
application
is
being
deployed
securely,
make
sure
you've
got
an
operational
regime
that
gives
you
security
and
protects
you,
and
so
that
that's
really
devsecops
is
just
saying:
hey
security.
Is
your
problem,
mr
developer?
Now,
let's
see
how
you
address
that,
but
I
think
that
was
last
year's
revolution
two
years
ago
revolution.
A
The
thing
I'm
really
trying
to
convince
you
of
today
is
that
cloud
native
devsecops
is
equally
your
responsibility,
if
not
more,
but
also
it's
a
slightly
different
thing,
and
so
why
is
it
a
different
thing?
So,
first
of
all,
when
you
move
to
cloud
native
you
the
developer,
you
own
controls
for
security
that
you
perhaps
didn't
own
in
the
past.
You
are
responsible
for
things
that
make
a
huge
impact
on
security
that
were
somebody
else's
problem
several
years
ago
and
are
now
your
problem.
Things
like
network
configuration
vpcs.
A
I
am
role
configuration
our
back
things
like
that
monitoring
logging.
All
of
those
things
are
things
that
you
are
operating
and
deploying
you're
deciding
on
you're
controlling
and
they
have
a
huge
impact
on
security,
and
so
it's
really
really
crucial
that
you're.
Looking
at
that
and
saying,
okay,
if
I'm
responsible
for
product
security,
if
I'm
responsible
for
making
sure
that
my
thing
is
going
to
work
any
hour
any
scale,
no
matter
what
the
attackers
are
doing
to
it,
that
means
I'm
responsible
for
making
sure
that
I
am
rules
are
configured
correctly.
A
That
means
I'm
responsible
for
making
sure
workloads
are
in
a
vpc
if
they
need
to
be
and
that
the
security
groups
around
those
things
are
correct.
That
becomes
my
responsibility,
so
part
of
it
is.
Is
that
you
now
own
things
that
you
didn't
own
in
the
past?
A
big
part
of
that
is
your
infrastructure
is
code
revolution.
The
fact
that
all
the
infrastructure
in
the
cloud
can
be
managed
as
code
and
as
part
of
your
code
repository
gives
you
incredible
velocity.
You
love
it.
A
I
know
you,
I
love
it
as
a
developer
and
I'm
sure
you
love
it.
Yes,
it
means
you're
responsible
for
more
things,
but
it
means
you
can
change
those
things
as
you
need
them
to
be.
You
don't
have
to
call
somebody
and
ask
them
to
provision
a
machine.
You
just
provision,
a
machine,
you
don't
need
to
change
around
network
configuration.
A
A
A
Well,
that
really
gives
you
a
path
forward
right,
and
the
second
thing
is
that
there
are
increasingly
a
large
number
of
tools
out
there
that
can
help
you
do
that
there
are
tools
to
help
you
scan
code,
their
tools
to
help
you
scan
infrastructure
as
code
and
terraform
scripts
and
confirmation.
There
are
tools
to
help
you
scan
container
images.
A
There
are
tools
to
help
you
with
monitoring
and
logging,
etc,
and
so
those
things
are
at
your
disposal
to
help
you
solve
this
problem,
but
step
one
again
is
identify
that
it
is
your
problem
to
solve
and
that
you're
responsible
to
solve
it,
and
so
then,
what
I
want
to
finally
take
take
to
that
is
what
are
the
pieces
of
this?
That
we
need
to
do
so
the
pieces
that
you
want
to
think
of.
A
First
of
all,
all
the
scanning
things
are
really
important,
but
now
you
need
to
make
sure
that
I'm
using
tools
to
scan
my
infrastructure
and
scan
my
code
for
cloud
problems.
So,
for
example,
if
I'm
scanning
deployment
scripts
terraform
cloud
formation,
those
are
cloud
constructs
that
I
need
to
scan.
I
need
to
scan
those
things
in
the
context
of
a
cloud
environment.
How
do
I
make
sure
that
my
cloud
formation
template
is
going
to
deploy
something
with
the
least
amount
of
risk?
A
How
am
I
going
to
make
sure
that
my
terraform
plans
are
all
deploying
things
that
minimize
my
risk
right?
So
there
are
tools
out
there
to
do
that,
and
those
are
things
you
need
to
be
using.
The
same
is
true,
for
I
am
rules.
I
am
role
least
privilege
is
super
important
in
the
cloud.
It's
perhaps
one
of
the
most
important
things
you
can
achieve.
It
might
don't
tell
me,
don't
tell
anyone
checkpoint
said
this,
but
it
might
be
more
important
than
network
security.
Getting
I
am
roles
properly
configured
into
cloud.
A
At
least
privilege
may
make
your
risk
diminish
more
quickly
than
getting
your
network
configuration
correct,
because
today,
increasingly
we're
talking
about
sort
of
zero
trust
interactions
between
resources
and
workloads
and
things
in
the
cloud
and
the
network
is
important,
but
it's
not
the
most
important
thing.
The
cloud
fabric
is
using
things
like
iam
and
rbac
to
ensure
that
only
the
things
that
should
communicate
do
communicate
in
the
way
that
they
need
to,
and
you
doing
that
configuration
correctly
is
going
to
make
a
huge
impact
on
security.
A
So
getting
those
things
right
are
really
important
and
then,
of
course,
making
sure
that
all
of
the
operational
parts
of
the
application
are
secure
as
well.
So
making
sure
your
logging
is
is
connected
to
something
that
can
analyze
it
for
anomalies
and
find
problems
and
you're
looking
at
things
in
runtime,
and
not
just
relying
on
the
fact
that
you
will,
I
deployed
it
securely,
it
must
be
okay,
it's
not
dev
it's
devops
and
make
sure
that
the
operations
piece
of
it
is
really
properly
done
for
security
as
well
and
then.
A
Finally,
what
I
want
to
leave
you
with
is
a
couple
of
things
or
a
few
more
a
few
things
that
checkpoint
provides
today,
where
we're
starting
to
really
try
to
look
at
you,
the
developer
as
one
of
our
customers
and
figure
out
how
we
can
help
you
do
your
job
better
and
again,
let's
agree
three
slides
ago.
Your
job
include
security.
Now,
how
do
we
help
you
do
your
job
better?
A
Traditionally,
things
like
cloudguard
are
aimed
at
security
people
with
their
dashboards
and
their
integrations
and
their
jira
notifications
and
their
slack
and
all
that's
great,
and
you
can
leverage
some
of
that
stuff.
But
you
need
to
find
tools
that
meet
you
where
you
want
to
be
so.
For
example,
checkpoint
sourceguard
product
is
a
new
tool
that
helps
you
do
source
code
scanning
in
your
repositories
and
pipelines
so
that
you
can
look
for
things
like
developer
error.
You
can
look
for
third-party
components
that
provide
risk,
etc.
A
Try
to
read
through
you
know,
hundreds
of
pages
of
documentation
to
figure
out
what
these
privileges,
but
rather
I
get
to
home
in
automatically
on
lease
privilege
for
my
workloads
and
then
also
what
we
call
no
code,
runtime
security.
So
the
ability
to
deploy
without
having
to
modify
code
add
all
sorts
of
hooks
inside
my
code
deploy
runtime
security
in
a
way
that
is
developer,
I
can
understand
and
manage,
but
I
can
do
it
automatically
in
the
pipeline.
A
So
that's
again
part
of
the
server's
workload
capabilities
of
cloudguard,
so
these
things
and
others
from
cloudguard
and
again.
I
know
that
I'm
using
checkpoint
as
an
example
because
that's
where
I
come
from
there
are
a
ton
of
things
out
there
there's
open
source
and
some
other
products.
These
things
are
all
your
friends
and
will
help
you
drive
to
more
secure
deployment
in
the
cloud,
something
that
is
now
your
responsibility.