Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Session: Palo Alto Networks - Reimagining the MITRE ATT&CK F... Keith Mokris & Ashley Ward

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sponsored Session: Palo Alto Networks - Reimagining the MITRE ATT&CK Framework for Cloud Native Applications - Keith Mokris & Ashley Ward

Sharing of Personal Information with Sponsors In order to facilitate networking and business relationships at the event, you may choose to visit a third partyʼs virtual booth or to access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth (e.g. by clicking on a third partyʼs logo in the Solutions Showcase or exhibitor directory, and any actions within the booth thereafter including viewing resources), when accessing sponsored sessions in the Sponsor Theater, or by participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), and details about the sponsored content or resources you interacted with. If you choose to interact with a virtual booth or access sponsored content, you are explicitly consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

This is an on-demand session and will be available for the duration of the event.

Today, enterprises use a combination of virtual machines, containers and Kubernetes, and platform as a service (PaaS) offerings to power their cloud native applications. While customers love and trust MITRE ATT&CK® to measure the effectiveness of their security operations and identify areas of improvements, they are now looking to extend this framework to their portfolio of cloud native applications. In this 15-minute demo session, Prisma Cloud will unveil industry's first comprehensive cloud native threat matrix. Watch a Prisma® Cloud expert walk you through the new interactive dashboard that references the ATT&CK Framework™ to 12 distinct categories for audits and events.

A

Hello, cubecon eu- we're really excited to be here today representing prismacloud and palo alto networks, reimagining the attack framework for cloud native applications. My name is keith mokris. I lead product marketing for prismacloud and I'm really excited to introduce my guest presenter, ashley ward field cto for prismacloud for two years at palo alto networks, ashley ward, has worked with customers around the globe, move to the cloud securely and protect their hosts containers and serverless applications before he joined palo alto networks through the twistlock acquisition.

A

He was at twistlock over two years working in the field with customers across emea, before that he was at aegon, helping them securely move to the cloud and leverage microservices architectures on red hat openshift and I'm thrilled to have him leading the demo portion of today's presentation.

A

Ashley, thanks for being here, keith thanks for having me we're, really excited to talk about the new capabilities that we've released as part of prismacloud focused on attack for cloud native applications and as we dive in, we really want to identify the fact that cloud security across diverse tech stacks is really challenging for a lot of organizations, and this is a very simple way to look at. You know a modern cloud-native architecture.

A

Certainly you have the public cloud infrastructure that prismacloud secures that you can use anywhere around the world and then in the middle. You have all of the specific tech, stacks or compute layers. That, or certainly everyone here at kubecon would be. You know. Well aware of so you have your virtual machines, your containers and kubernetes stacks your pas stacks or serverless functions.

A

All that you not only need to protect at runtime, but also address vulnerabilities and compliance concerns, and then certainly you have all of the public cloud or cloud native services that connect to these applications.

A

So you have the identity, components, automation, storage, networking components, and this is really important to make sure that they're configured properly and secure, as all of these things really come together to form your cloud security posture and then, when we look at the new feature that we're really excited to talk about in today's demo. We're looking at um attack for cloud native applications and a lot of you know.

A

Users in the audience are certainly aware of mitre and their incredible research and guidance when it comes to endpoint protection and xdr, or protecting the public cloud and other important resources.

A

And one of the things that we've done is focused on bringing attack in this new dashboard that we call attack, explorer, focusing on hosts containers, kubernetes, orchestration and serverless functions to help organizations understand any incident or audit information. So they can, you know essentially get guidance on how they can remediate these issues.

A

So what ashley's, gonna walk through is our dashboard to help organizations, understand, audits and attacks, how we leverage and gather all of this data across any of your different application architectures and how we've mapped all of these different responses across the 12 distinct categories that you'll see in attack explorer and then, ultimately, one of the very cool things that we can do with prismacloud is look at audit events and look at essentially time of detection and gain deeper details, whether it's audit information or forensic event data you know, so you can essentially understand any compromise or incidents that may be impacting your cloud infrastructure and without further ado.

A

This really sets the stage to hand the ball over to ashley. To guide you through. These incredible features.

B

Thanks very much keith, um let me get my screen shared out and uh pick the right uh screen share, which has all gone missing there. We go so you, hopefully my screen's, coming through okay, as keith was pointing out. We have taken that attack framework and we've presented it as this attack explorer and really the whole thing about this is being able to visualize. I mean that you can actually action all that information that can be coming through. So here everything's separated out.

B

We could have been getting all this as audit information, but let's pick on one, we've got here obfuscated files, so a nice, simple click. There brings up my next menu to say right. What is it we're actually looking at here and I've got that actual event that happened.

B

We've got an audit event here, a rather nice file in my demo, environment called slash, evil has appeared here, and but what we're doing is, if you look at that information, it can be overwhelming, and so you can get all this as logging information, but to actually have it tied back to say. Okay, this particular event is triggered. This is what's shown as the obfuscated files, and we've got all that container information and more that we can pick up on, but using the exact same window that I've got here.

B

I can then drill further into saying. I know that a rule was triggered, but what does that actually mean? So I can look at the forensic data that we have for this now. This is for a particular running container. We can see the container started. We've got all that information about it and we can see that we've got some behavioral learning that takes place and I'll I'll dive into that in a second. But we've then also seen more activity.

B

That's happened, we've had a an incident has been raised, there's a suspicious binary here we see the binary being created and we can see that detail there. That appeared again now. All of that is then you know we could have triggered this and sent this out to logs. We could have automated process based on this event happening, but this is us looking to say: okay. Well, we had this happen. We've got the forensics for it.

B

We can see the effect that was generated, so in this case, prismacloud was set to only alert on this, because, of course, it could have been blocking that event from happening and we can even see the rule.

B

That's there and again I'll go into that in slightly more detail in a second now, when we talk about that run time, we're not just saying okay, let's write a rule that says if something called slash, evil gets created then take some activity, but instead this is all that automated learning that takes place so examining what normal is across, and we can see here the processes.

B

What are the things that we've learned and in this demo here we can see: we've learned that it should just run tail and nothing else, and so when something deviates from that normal from the processes, the networking or even to the file system. If we had any file system activity to say what's normal, then we can build up that runtime model and generate those alerts. Now this is all about making it easy to consume.

B

Going back to what keith said, you're going to be focusing on all your different cloud accounts and you're, not just focusing on them from a security point of view, you're focusing on them.

B

What so this is where we come in at the raison d'etre of what we do, which is about saying we will secure across all those different things that you're running so back here. Back to this, we didn't need to create a rule to say suspicious elf header found. We didn't need to say if the file evo gets created. We did all this automatically now. We can, of course, override these.

B

We can see here that, from this alert, we've got the actual rule that was triggered and impacted, so we could dive into that rule to say well, actually we'll modify the rule because in our environment, although we didn't behaviorally learn that slash evil gets created, we always want that to happen. Maybe a very silly example there, but you can see how we can immediately drill in to whitelist blacklist. We can do that learning we can change as required and so going back to that learning we can even from here just say.

B

Well, let's just extend that learning. We can go to that and say we did learn this. We didn't fully test our application, and so now, let's click into that learning and go further so coming out of this and back out to that explorer, and this feature we're taking all of that work that we already do as a as a product.

B

So looking at the kubernetes audit events that are coming in looking at the different things that might be happening and pulling them up into the right categorization as per the framework here, another example just clicking there, we can see that actually, we've got cubecuttle or cubectl has been downloaded into a container. We didn't need to write those rules, but even if we did write a custom rule for this, we have it. We have it appearing here.

B

So it's easy for a security person to see it's easy for a devops team to see so using that role-based access control to then get the correct visibility. We can see why this would be bad.

B

I might, in my devops days, maybe have thought exactly into a container was a good idea, but actually, of course it's not so diving into yet another example in that explorer, I very quickly just drilled down into what was the actual event and with this blob of the event I could, if I wanted to then use our custom resource and custom query language to be able to say, alert generate me a letter on this.

B

If there's a problem, and so these are just a glimpse into a single little feature and as keith said, you know in that beautiful picture, you're worrying about your cloud service providing account. You want to look at all those different things you might be running and all those different environments- and that's the value, add for a team as opposed to trying to learn and write. Is this normal behavior for my container within.

A

B

Miter framework, it's all done for you, so that listen. Thank you very much everybody for listening to me, thanks keith, for uh for what a great little bit of slides, which I am going to find and steal and reuse, and please everyone do swing by our booth for more information or visit, palo alto networks, calm and at that enjoy the rest of kubecon. Thank you very much.