Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 2 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Keynote: Cloud Security’s Hidden Force: Threat Detection - Loris Degioanni, Sysdig

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sponsored Keynote: Cloud Security’s Hidden Force: Threat Detection - Loris Degioanni, Founder and CTO, Sysdig

Threats to containers and cloud services are growing. All it takes is a vulnerable dependency, or a configuration mistake, and the entire environment is compromised. Guarding against every unknown is impossible: that’s why providing security teams with solid visibility of threats, and a path for responding to them, is so important. Threat detection is a powerful opportunity for the cloud native security community. Together, we can defend against vulnerabilities that security teams haven’t yet addressed.

In this keynote, Loris Degioanni, Founder and CTO of Sysdig, will talk about why your last line of defense is just as important as your first (and likely more so).

A

Good morning we are living in interesting times, I mean think about that just 15 even 10 years ago. We would have imagined that a large part of the world software would be running in containers. We would be all using sophisticated cicd pipelines that our software would be uh organize the microservices and schedule by software like kubernetes or other orchestrators.

A

That deploying our software in the cloud would be the rule and not the exception, so definitely interesting times, but we are at a security conference and from the security point of view, if you think about that, the challenges that we are required to deal with to solve are largely the same, uh fix, find and fix vulnerabilities in our software manage configuration and permissions. This is particularly critical when our software is deployed in the cloud, and essentially everybody has remote access to our infrastructures, mid compliance, which is a moving Target every country.

A

Every every continent is constantly changing rules from this point of view and, of course, detect and respond to threads. So when we look at the security landscape from the perspective of cloud native, we can see two Trends. The first one is towards shift left right, and this is driven by The increased, huge usage of cicd security by the fact that we are centralizing our artifact, our software, the dependencies in repositories where we can then validate and check for vulnerabilities better.

A

The second trend is a trend toward the right right toward runtime security, and this one is driven by the increasing complexity by the orchestration by the fact that uh you know microservice based infrastructures that Iranian kubernetes are maybe easier to operate, but it's hard to actually figure out what's happening at runtime and when we think about these two Trends, the one toward the left and the one toward the right. Typically, in the context of quantity security, we tend to think about the one toward the left. First right, it's natural, it fits very well the model.

A

It's also easier, if you want I shouldn't, say easier in the context of security, but you know what I mean I'm here to argue a little bit for the shift to the right and the fact that it's equally important in particular, you know, runtime security is key to detect attacks blocks your day.

A

Events prevent drift and many other things I like the squad from the cloud security, podcast, detection and response is all about solving the security problems that the rest of the security organization has been unable to solve. You can have a fantastic supply chain security. You can have great vulnerability management, but in the end the Box stops where your applications are running in your production environment. So without great visibility without uh granular ability to see what's happening, you have a gap, you have a big gap.

A

Fortunately, the cognitive computer Foundation is a tool that can help you with this. Its name is Falco I'm, one of the Falco contributors and I like to describe Falco as the security camera for your Cloud native infrastructure. Falco is traditionally based on ebpf instrumentation and can see what every single process does in each of your containers and hosts.

A

But in time the community has extended it to support, for example, Cloud logs, so you're able to tell when one of your users logs in your AWS environment without multi-factor authentication, or we embedded it in GitHub, so you're able to tell when somebody commits in one of your repositories a password or a secret, or something like that uh in general. Falco is a great community that can help you. You know, get started and also solve Advanced problems that you might have with the tool as I was saying before.

A

Typically, you know, shift left is what we worry first and that's totally natural, but I argue that understanding what's happening at runtime is not only equally important but highly complementary and a key component of a truly uh well-designed security strategy for cloud native so think about it today and go take a look at Falco.

A

Thank you very much.