Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 3 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Keynote: Kubernetes is the Perfect Platform for Enforcing Zero Trust Security - Fei Huang

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sponsored Keynote: Kubernetes is the Perfect Platform for Enforcing Zero Trust Security - Fei Huang, VP Security Product Strategy, SUSE

Zero Trust security is a hot topic these days, in more than just cloud native deployments. But with most new applications and infrastructure development being done with cloud native tools and infrastructure, zero trust is the single most critical security strategy that should be employed to secure Kubernetes environments.

In this talk, Fei Huang, VP of Security Strategy at SUSE and co-founder of NeuVector, talks about what is a zero trust strategy built around cloud native, and where zero trust protections can be enforced with examples from the ecosystem.

A

Hi everyone nice to meet you today. My name is FEI. Huang I came from a social security, so today my topic is about. Kubernetes is a perfect platform for enforcing zero trust security. Let's get started so let's use the famous log4j vulnerability as an example.

A

I think everybody and urban knows that first, a lot for gcpe was discovered on November 2021 only one week after that, right there's a real world exploit attempt was reported and then, of course the patch was released a few weeks later in the next few weeks and months we keep seeing new patches uh published, but at the same time, new related cve are also reported.

A

So for the companies I mean we have a lot of clients, customers. They have to keep patching their applications, keep waiting for the new patches right.

A

So this whole process takes a few weeks or months or even more I. Think yesterday, Brian mentioned there's a cve not being patched after 15 years, that's kind of crazy, so they all. Obviously we all understand. This is a chasing game. We call this reactive security model, so we have to scan, monitor, detect, respond based on real incidents. We have to keep waiting for the new patches. This is working, but I, don't think it's efficient I, don't think it's enough right.

A

So how about the CVS that without effects? How about you know? Can we prevent log 4G like critical security issues, even before it's been discovered? The answer is yes, please think about this. How about we can detect attack at the network entry point even before it hits the real application?

A

How about we can block the command control Links at real time, and we can block any suspicious process of file system access. No, because this is a never-thinking process before it could be a remote code execution, it could be a crypto Miner and the idea is we should minimize the attacking surface right at runtime and we should lock down the behavior of every Running part.

A

So we call all those good functions, proactive security model or zero trust, the security controls.

A

So why kubernetes is the perfect platform for this new security model? Let's use a real workflow think about that see. A developer could Define the security manifest into a yaml file. It can even Define the application runtime forward policy into the Yama file as well, because developers is the only person know how this container is going to talk, couldn't communicate in the runtime. So those information can be checked into the git repository same as their source code right and then the build pipeline going to carry it over all the way to the writing.

A

Clusters choose a new vector-like Solutions. We will be able to pick up those security Manifesto. Also the policies directly from kubernetes at runtime, then Federated. The policy out, enforce it right away. The beauty is this. Whole process can be fully automated. You know, oh I mean you can see that the kubernetes does make a security solution, much smoother, much stronger and much better. That's that's why so I would like to use two real customer profiles to emphasize runtime zero trust. Security control is very important, a customer which is a fortune 200 in the price.

A

Another one is a fully SAS based Financial Service online bank right. Interestingly, they all run their containers in multiple, complicated Cloud environment. They have you know: Cloud, hybrid Cloud, multiple cloud, on-prem or even on Airgas environment. So it does require security to be managed scaled. The same way, so the multi-cluster, Federation and also the security management is, is needs to be supported.

A

Another strong requirements is, you know those applications in production are mission critical. Basically, you know that company's most important assets it does require. You know they have a strong runtime protection in place, so they use zero trust, runtime protection with security Automation in place to make sure it's not slowing down the devops process and there's also compliance requirements in in the play right uh for the uh those Mission critical. You know workloads.

A

There are all kinds of compliance requirements in different countries, different Industries, so to satisfy that they use the layer, 7 container, follow with buff and DRP enabled, which does help them to pass auditing from, for example, stock, 2, PCI, DSS or HIPAA.

A

So, due to the time limitation today, I mean I can only highlight a few things about zero trust for kubernetes. For more details, please feel free to stop by our booth at the solution showcase. We also have a free ebook from this QR code. You can download. So that's my presentation today and thanks everyone. Okay,.