►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: Cloud Native Security Market Trends and Drivers - John Morello, Vice President, Product, Prisma Cloud
Speakers: John Morello
Securing your Code to Cloud journey is a daunting task. Applications are spread across multiple cloud platforms, they are highly portable and ephemeral. As the attack surface is increased and there are many attack vectors throughout the application’s lifecycle, tune into this keynote to hear about the latest market requirements and learn about the anatomy of a cloud native application security solution.
A
Hi
I'm
John
Morello
I'm,
the
vice
president
of
product
for
prismacloud
at
Palo,
Alto
Networks
I,
wanted
to
share
with
you
today
a
little
bit
of
an
overview
of
what
we
observe
as
current
market
trends
and
what's
driving
those
Trends
in
the
cloud
security
Market,
something
that
really
impacts.
Everybody
here,
that's
attended,
kubecon,
some
of
the
real
drivers
of
what
is
shaping
Cloud
Security
today
or
what
you
see
on
this
slide.
A
First
and
foremost,
is
that,
even
though
many
organizations-
and
particularly
most
of
you
that
are
kubecon
here-
are
already
well
into
your
Cloud
migration
Journeys,
that's
only
accelerating
and
increasing
for
a
lot
of
organizations.
You
know
one
of
the
metrics
that
we've
heard
for
a
long
time
is
about
the
portion
of
workloads
that
would
be
in
the
cloud
and
it's
looking
now
within
the
next
two
years,
more
than
two-thirds
of
the
workloads
that
organizations
run
will
be
hosted
in
Cloud
providers.
A
So
a
really
significant
shift
over
just
the
past
10
years
from
what
was
primarily
an
on-premises
deployment
model
to
one
that's
predominantly
now
within
the
public
cloud.
Secondly,
is
that
applications
are
increasingly
becoming
containerized.
Of
course
that's.
Why
we're
all
a
kubecon
right
is
the
fact
that
that
this
Revolution
and
the
way
that
we
package
deploy
and
run
applications
is
really
shaping
every
aspect
of
software
development
and
operational
life
cycles,
and
you
can
see
that
that
really
at
this
point,
almost
everyone
is
utilizing
containers.
A
A
That
kind
of
bring
things
the
up
way
where
you
can
take
a
serverless
function
and
execute
that
in
a
self
managed
environment
that
might
run
on
kubernetes
and
of
course,
all
that
is
just
something
that
runs
on
top
of
virtual
machines.
Virtual
Machines,
of
course,
are
not
going
anywhere
there's.
You
know
many
millions
of
VMS
that
are
out
running
right
now
in
the
in
the
cloud
and
probably
will
be
for
some
time
in
the
future.
A
If
you
think
back
to
the
to
the
historical
Norms,
when
you
were
running
an
application
that
might
be
a
you
know,
an
interior
app,
you
might
have
a
couple
of
VMS
for
the
front
end
a
couple
for
the
applications
here,
maybe
a
cluster
database
from
the
back
end.
But
as
you
decompose
that
now
into
micro
Services,
you
may
have
many
different
containers
that
are
running
that
front-end.
Many
different
containers
running
the
applications
here,
Each
of
which
is
built
as
a
micro
service,
and
there's
lots
of
benefits
to
that,
of
course.
A
But
the
number
of
things
that
you
have
to
think
about
security
for
is
a
lot
higher.
There's
just
more
entities
to
deal
with.
Secondly,
is
that
those
entities
are
changing
more
quickly.
One
of
the
reasons
why
you're
moving
to
this
model
in
the
first
place
is
because
you
want
to
enable
more
rapid
Innovation.
A
You
want
people
to
be
able
to
iterate
on
those
micro
Services
more
quickly
and
because
of
that,
the
environments
that
you're
having
to
secure
are
changing
on
a
much
more
frequent
basis
than
they
used
to
you're,
not
deploying
a
VM,
and
you
know
kind
of
running
that
VM
for
years
on
end
you're,
probably
deploying
new
versions
of
your
containerized
images.
You're
running
those
maybe
once
a
week,
maybe
once
even
a
day,
you're
changing
them.
So
there's
a
lot
more
churn
in
that
environment
and
then,
finally,
there's
no
one
single
Cloud
pattern.
A
Most
organizations
have
some
kind
of
hybrid
architecture,
especially
larger
organizations
have
significant
investments
in
on-premises
infrastructure,
private
clouds.
Most
organizations
are
intentionally
choosing
to
be
multi-cloud,
so
they
have
options
and
take
advantage
of
Technologies
at
an
individual
cloud
provider
might
do
best
and
and
best
of
breed
within
the
industry,
and
so
it's
not
just
about
saying
everything
is
one
particular
cloud
provider,
but
you
need
to
be
able
to
protect
across
multiple
different
Cloud
providers,
including
yourself
as
a
private
cloud
provider.
A
They
require
there's
really
kind
of
three
fundamental
areas
that
that
we've
seen
the
organizations
that
are
most
successful
on
that
those
three,
these
three
areas
of
the
ones
that
those
organizations
really
focus
on
and
have
the
best
outcomes
around
first,
is
that
they
look
at
security,
not
just
as
something
that
happens
after
you
deploy
the
application.
But
it's
something
that's
a
full
life
cycle
thing.
So
not
only
is
it
not
post-deployment
exclusively,
nor
is
it
pre-deployment
like
in
a
shift
left
capacity
exclusively.
A
Instead,
a
good
Cloud
native
application
security
solution
needs
to
protect
and
provide
visibility
and
enforcement
from
code
to
deployment
to
test
all
the
way
into
the
cloud
runtime
environment.
Secondly,
that
stack
needs
to
be
largely
technostic.
In
other
words,
it
needs
to
be
able
to
protect
you
in
all
those
different,
diverse
places
that
we
talked
about
private
Cloud,
multiple
different
public
Cloud
providers,
as
well
as
across
all
the
different
workload
form
factors
where
you
might
run
that
application
and
then
finally,
it
needs
to
be
application
aware.
A
You
know
you
don't
want
to
have
a
security
solution
that
that
doesn't
have
intelligence
about
the
way
the
application
works,
because
without
that
intelligence
you
can't
really
protect
the
application
layer
traffic,
the
kinds
of
threats
that
are
unique
to
a
particular
kind
of
microservice.
So
not
only
does
it
need
to
be
something
that
can
protect
you
across
the
life
cycle
of
the
app,
but
it
needs
to
understand
how
the
application
works,
so
it
can
provide
a
targeted
preventative
kind
of
security
control
to
protect
that
particular
part
of
a
given
application.
A
So
these
three
attributes
are
what
we
see
the
most
successful
organizations
that
are
transitioning
to
the
cloud.
These
are
the
three
attributes
that
we
see
them
really
focusing
on
choosing
solutions
that
help
address
those
and
meeting
the
demands
and
the
unique
aspects
of
securing
Cloud
native
architectures
in
this
evolving
multi-cloud
reality.
Thank
you.