Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 3 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Keynote: OpenClarity: A Community-Led Approach to Cloud-Native Applicat... Sarabjeet Chugh

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sponsored Keynote: OpenClarity: A Community-Led Approach to Cloud-Native Application Security - Sarabjeet Chugh, Senior Director, Global Head of Product-Led Growth, Cisco

The complexity and distributed nature of modern apps have increased the number of attack vectors. As more mission critical workloads move to cloud native architectures, there is an urgent need to protect new attack surfaces that arise. Yet, there is no single commercial tool that can comprehensively secure cloud native apps. Developers need flexible and extensible tools that are cloud native, and not a bolt on from the legacy world. And because no one knows more about what developers need than developers, it makes sense to come together as a community to create tools that developers love. Security for developers by developers. That’s what the OpenClarity suite of OSS offers - a comprehensive solution to cloud native security. Come hear all about how Cisco is leading the charge on community-powered innovation in cloud native security, AI/ML, API security, observability, network automation, and more.

A

Good morning, how's everyone doing great in the next few minutes we're going to talk about three main things: one is I'm gonna. Let you in on Industries, most well-kept secret in the open source area. Next we're going to play a little game whip out your phone phone cameras. You, you have a chance to win great prizes at our booth, Booth D1, and the third thing is we're going to learn about a cool new technology that I'm really proud of, and hopefully you like it too- that you use in your environments.

A

So let's get started, my name is sarabjit and we are hiring I know times are tough if you or somebody you know, is looking for a job. We're hiring across the board at Cisco. Hit me up so the most well-kept secret in open source is Cisco, loves, open source. We've been quietly innovating in the open source for a little over five years now, and we have a lot of contributions that we made in the open source area, the most prominent one being open Telemetry. We are one of the major code contributors to open Telemetry.

A

We have people in the governing Boards of committees like kubernetes and and other areas, and we've also come up with new open source project and incubated new projects, a few of which, which I'm going to talk about in this presentation, next whip out your phone 30 seconds, Point your camera to this QR code and give my project a star and show that at the booth, your time, let's, let's start this timer.

A

Thank you thanks. Everyone who's doing this. These are the GitHub IDs of people who are signing up. We have a function that is monitoring that starring. Thank you so much, and you have other opportunities to look at this and I'm going to give a demo about this uh in in a few minutes.

A

So this is the Crux of uh that technology that we we are so proud of. In the open source, Cloud native uh security space, it's called open, Clarity.

A

It's a suite of Open Source projects that allow you to do: API security, using API, Clarity, kubernetes security, both the static container image scans and securities, as well as the runtime using Cube Clarity, and then the function Clarity, which is the latest Innovation, which we've open sourced recently at kubecon in Detroit, and we I'm going to give a quick live demo of that, and we are so proud of this- that we have deployed them in our production and in our commercial products panoptica, which is that comprehensive, secure security for your kubernetes apis and serverless functions and similarly, on the right hand, side.

A

We have operators ecosystem that you can make your life easier to use, istio and Kafka using these operators and it's deployed in the commercial product kaliste. So, let's get started with the demo of function. Clarity function, Clarity is a keyless code. Integrity solution for serverless functions, Lambda Azure functions, Google and I'm, going to talk about the Lambda function, security, Now.

A

So this is an example. If you can see the screen of a trivial Lambda function that we want to protect against. You know at the CI CD level your code is is protected, but now you run it. It runs perfectly fine and you can see in in the configuration you can run up to 10 concurrent Lambda functions and that's why it allows you to run this and you could run it and it it works now.

A

The way function, security works is there's a verifier serverless function that is running uh in your environment, in your Cloud environment that takes the signature the first time you you log in and send that deploy that serverless function after that, any malicious code that gets sent to it it traps and, and it disallows running those serverless functions. So let's try hacking that serverless function and try running it.

A

So ah so I've already got this hacked at CNC. So suppose somebody took control of your git repository and made this code change and is trying to test deploy. This, it won't be allowed rate exceeded, is the message that comes out. Essentially, what that means is that that can the concurrency ratio that that I showed you earlier that has been reset to zero. As you can see, it was 10 earlier and now you the function cannot be invoked while that is zero. So that's that's what that function.

A

Clarity allows you to do easily and um the next step going back to my presentation so.

A

Really I want to leave you with these three thoughts. If you want to learn more about Open Clarity hit, see us in the booth D1 and or make a note of this URL CSCO cloudsec and then give us a star on GitHub for this function. Clarity I really appreciate that and see us in the booth. Thank you so much.