Red Hat OpenShift In the Clouds | Red Hat Livestreaming, 26 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: In the Clouds (S2E10) | Wei Lien Dang

Description

Does a strong open source community help improve product security? In today's episode, Red Hat's Senior Director of Hybrid Platforms Product & Marketing Wei Lien Dang, and former Co-founder and Chief Strategy Officer at StackRox, joins us to talk about the advantages of open source with regards to security. As Kubernetes is changing how developers build software and containers bringing a unique set of security challenges, using open source software gives the benefits of transparency and a community of eyes working to reduce bugs and quickly fix flaws or vulnerabilities. We'll talk about the different approaches to container security and Wei's experiences with open-sourcing StackRox and building an upstream community. We'll also cover the evolution of Red Hat Advanced Cluster Security for Kubernetes and upcoming product features. So please join us for an open discussion about the future of cloud-native security.

About In The Clouds:
Red Hat’s senior leadership is having to execute at an ever-increasing pace. That means that today's technology decisions have to balance short-term risk with long-term gains. This unique series provides host Chris Short inviting thoughtful and candid discussions with each guest.

Follow us:
Wei Lien Dang https://twitter.com/weiliendang
Chris Short https://twitter.com/chrisshort
OpenShift https://twitter.com/openshift

Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1

About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com http://red.ht/3nJ6AKX
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com http://red.ht/34xQoER

#RedHat #OpenShift #Kubernetes

A

A

Good morning good afternoon good evening and welcome to a special edition of in the clouds, I am chris short host of red hat live streaming and I am joined by the one and only whaling dang senior director of hybrid platforms, product and marketing here at red hat he's also the former co-founder and chief strategy officer at stackrocks who was acquired by red hat not too long ago.

A

How are you today.

B

Why I'm doing well, uh chris thanks and thanks for having me here, it's great great, to be on.

A

Hey it's great to have you on thanks for uh thanks for saying yes, so I've been looking forward to this one believe it or not, because I've been a stack rocks fan for a while. Now um back in kubecon san diego, uh the stack rocks folks asked if I could just do like a high-level security, talk about the cncf landscape, basically right and like all the tools that are in it, and I really had an appreciation for stackrocks because you didn't neces, you didn't necessarily like make yourself so hard to replicate.

A

Like you stayed kubernetes native right, like somebody could have done the exact same thing, you did potentially in a different way and still use those native components um or they could have gone a more proprietary route, which I think is part of the reason why we were like. Oh, we should acquire stack, rocks kind of you know. Can you tell me you know a little bit about yourself and you know we'll skip the icebreaker question, because you want meta meta universe on me for that.

A

So let's just dive right in you know introduce yourself and talk to me about. You know stack rocks becoming, you know, part of red hat.

B

Sure I mean so I was a co-founder at stackrocks and you know today, head up, you know what we've rebranded the product as which is red, hat advanced cluster security for kubernetes or acs. For short, yes, and as you mentioned, I mean one of the really key.

B

You know approaches that we took around thinking about how security should be handled in these environments is to go with what we call kubernetes native and what we think of as kube native is about integrating with the existing security capabilities and controls in you know that you know existing kubernetes, allowing users to utilize the same abstractions and constructs and primitives that they're already familiar with, but also extending those capabilities to address your use cases across the entire life cycle, so vulnerability management, configuration management, compliance threat, detection, all those things that give you sort of an end to end.

B

You know security platform from build to run time and for me, just like you know, kind of how I got into the space for a bit. Is you know I've been in and around you know, infrastructure and infrastructure, security for the last decade or so so worked at large companies? You know focused on cloud infrastructure and virtualization and then actually joined a company called corels as head of product who and that company was also you know, acquired by red hat. So in some sense, like you know, all roads lead to red hat.

A

Okay, but I think.

B

But I think if you, if you went back like five years in the ecosystem, you know five six years and kubernetes was still a little bit more nascent.

B

You know there was a lot of interest and you know demand for starting to run cloud native technologies in production and for mission, critical use cases as you as you know, but you know there were significant gaps in security capabilities, and so companies like red hat and other contributors, you know started to think about how they could insert, and you know, build out things like role based access control and you know other you know related capabilities. That would you know instill more confidence in using um you know, cube and and related. You know software.

B

You know in environments, you know where you know. Security was a significant consideration right.

A

Yeah- and you know it's it, it's one of those things like I used to work in very restricted environments, and it was you know, one one of those things. If you didn't stick it, you weren't putting it on the network so like there was this process of all offline until it went on to a network that was disconnected from the internet. So it's like well wait a minute.

A

You know like. Why do we have to.

B

A

The internal stuff, but yes, you know you can't let you know you've, there's all kinds of security breaches that have happened because of either bad user education or bad controls, and you know it stack, rocks and acs bring a lot to the table. In that regard, I feel like for.

B

Sure I mean to yeah to be, to be fair, I mean like it's. Security is complex.

A

B

And, and if you look at like so many layers of the stacks, you know so many parts of the life cycle like it's right, you know something can easily go missed, you know or or go wrong or unexpectedly, and you know I know you want to talk about this, but this is where I think, like you know getting you know more people into the mix more eyes.

B

You know on a particular topic can really help, but for us I think you know the whole decision to go around kube native was to try to align with how the cloud native community was thinking about it, how you know the ecosystem around cncf and so on? You know how they wanted to kind of approach.

B

um You know being open. You know in terms of solving you know, key security problems that that have existed so for for us, you know, coupe native is also about um you know aligning you know with the overall direction of you know how the extended you know, kubernetes, community and cloud native community is thinking about security right.

A

And- and you mentioned security being hard- I mean nowadays it's harder than ever. It feels like you know. If you have watched the headlines from 2021, it's either been coronavirus or ransomware right. So it's one of the other right um and you know, we've got an executive order to talk about. You know all manners of securities and you know safeties that are going to be put in place or should be put in place. But now we have nif standards.

A

We have a hardening guide from the nsa, we have cis benchmark, we have guidance to make the entire pipeline solid. Where does acs fit in the pipeline? And where do you think people benefit the most from its capabilities.

B

Sure- and you know to your point about you- know cyber security being top of mind. I mean you know just reading this morning about how you know, like the presence meeting with ceos of a bunch of tech companies, and you know trying to figure out. You know sort of these pressing issues around cyber security that make make a more open dialogue. I think you know across the industry, but you know I think, when it comes to sort of industry standards.

B

I think one of the great things is that you know people have started to coalesce around this sort of set of best practices. You know when it comes to securing containers and kubernetes, and things like that- and you mentioned some of you- know the organizations that have been publishing guidelines and I do think if you kind of look at or read through those in detail- and I mean they- they can make your eyes water a bit. I mean oh yeah, they get really they.

B

You know they get really detailed, but but I think, if you kind of take a step back, I mean there is a lot of overlap. You know between them um and I think what that signals is that there is somewhat broad recognition or fairly broad recognition that you know there's a set of you know common methodologies or you know, controls or things. People should really think about getting started with and now look there's a lot like. If you look at say the cis benchmarks, I mean there's like hundreds of checks or something like that right.

A

B

So I think how acs fits in is in two ways, which is you know, and I think it fits in with how someone might approach tackling these things. Like one is like you, you can't try to get. You know hundreds of things out of the box yourself and so not possible. I think one is like think about where you start, and I think you know the starting point for nearly every organization or end user is typically like with you know, build like as you're building images.

B

You know container images like how do you think about securing them? How do you prevent vulnerable software from you know entering your environment? Those are like just like the low-hanging fruit. You know, I think that you know exists for people to to start with and then how acs enables that is you know we give you a you know more turn. Key experience in terms of you know, automating those checks and providing those you know by default out. The box, like our whole philosophy, is like you know we want to make. You know these.

B

um You know these environments secure by default. You know, and that's that's not to say that you know takes away. You know your choice of right. You might want to customize or meet like specific needs of you know your applications or or your environments or your organization, no policies, but you know we want to give you like a reference point to start with. Otherwise, like I said that you start with these manuals effectively and you're, just like how you know, how do I actually go about this? It's it's! It's impractical. In most cases,.

A

Right, yeah, and so this kind of brings us to the intersection of automation, which to me means devops and security, which means to have sec, ops and containers and kind of, like the two intercept pretty hard and fast uh nowadays. But you know how, where can people find actual actionable places to start injecting in their pipeline right, like not just at container build time right but like making? That repeatable is also very important too right.

B

Sure you know and I'd be curious for your perspective. I mean, I think for me, like I suddenly think about this in terms of like there's the abstract and then there's a very practical, like I think you know conceptually like there's so much. You know uh that you know in terms of how containers and devsecops can complement each other it in the sense that, like okay, it's like developers and devops teams are the ones who are, you know really driving the usage of containerization and you know with devsecops.

B

You want to shift left and have you know those individuals? You know start to think about security early in the life cycle, anyways and then there's like the properties of containers. It's like you know, they're meant to be declarative. You know you can kind of specify and and scope down what your given container is supposed to do, um and that also helps security right and it makes it easier.

B

For you know people who are you know more targeted in terms of how they're operating you know for a given application to actually you'll understand what security controls need to be. You know assigned to a particular you know or apply to a particular application.

B

I think practically like you know where you know it makes sense to sort of start with injecting security controls. Is you know, as you're building I'll, even see even before you're building images? You know.

A

B

Like I, I like talk to people and I'm like hey, think about like what registry you're going to allow. You know image pools from.

A

B

Know like make sure it's like a trusted registry like either your own or like from a regular vendor. I mean and.

A

B

Even public, you know public, you know image repositories from you know. um Large vendors still have backdoor images right. You know you, you read.

A

These things you hear about it kind of on and off throughout the year. It's like, oh well, if that little node.js package had something, then that means this container everywhere had something so.

B

Yeah yeah yeah, like.

A

It's scary out there right.

B

Well, you know it's like everyone, everyone's going after you know, crypto, jacking and cryptocurrency chris. You.

A

Know for now you're about for now yeah I mean you.

B

Know you hear about these like large-scale campaigns? You know that, like you know, microsoft and others publish about so but anyways like you know, I would say like. Where? Can you start it's like you know, when you hook up a registry when you, uh maybe you decide to set up a private registry? It's also, um you know for your base images yeah, it's like even before you build it's like for your base. Images like is.

A

B

Yeah yeah is it from someone like red hat? You know who's it. You know trusted reputable vendor like do you have the source code for that based image, like all those things, so I think you know like there. There are definitely ways to build in good security. You know approaches in hygiene like even before you start building and once you start building, I think you know hooking into um and taking advantage of automation via you know, integrating with the cicd pipeline, you know often makes sense, and so that could be doing configuration checks.

B

It could be. You know, scanning for vulnerabilities. You know we we put out you know uh about a year ago. Actually, nearly a year ago, this like open source tool, called coolinter, which is like you know. I love that tool. Yeah, it's like you know. Developers are like working with their home charts and yaml files, and maybe they misconfigured something so we'll help.

A

B

It happens for sure, like you know, you're you're busy or, like you know, you're doing a bunch of things, and you know maybe you miss this configuration like, um and so that's how acs or you know stack, you know, sort of our open source project cube, link or you know, whatever, whatever else in terms of how we support um across our product portfolio. That's how you know we can. You know, help end users kind of avoid some of these problems.

A

Yeah and just I'll just read the about real quick for cubelenter cubelender is a static analysis tool that checks, kubernetes, yaml files and helm charts to ensure the applications represented in them, adhere to best practices. So there's some best practices baked into this tool scans the files that you're trying to load into kubernetes, and you can, then you know double check that you know what you're doing is.

A

Actually you know good or going to open up some back door that you're not aware of, uh like the amount of automation that I think you can insert for. Containers nowadays is vast right and cuba linters, just like just make sure your stuff's good and put it in the repo type thing for me right, like constantly check those files for new rules, because I mean you just had a release yesterday of qblinter, so it's good stuff, um so yeah.

A

Thank you for mentioning that.

B

You know what I mean: what are your thoughts chris? Like I mean you talked to a bunch of folks in the ecosystem, and you know industry, like you know, how are they thinking about like desktops and containers like you know, furthering each other, just curious to get your perspective.

A

I mean right now. It feels like the hardest thing, for a lot of folks to do is to get security out of its mindset of here's. Your checklist go right like no. I I would like you to be part of the problem. You know process of getting this code to production right like there's tooling, you use, then please inject it into the pipeline.

A

So a getting security just come talk to you and share tooling, has been a problem in my past for sure, and I still think some developers are having that issue and devops folks alike are having that issue these days, especially given that a lot of the regulatory stuff is met by policy internally.

A

So a lot of time is being spent writing policies to meet certain new thresholds or certain new guidelines, and it's not necessarily a holistic um process. Now it's very much siloed still and that security team needs to be pulled in big time.

A

B

But I mean I I don't go. You know you're you're, saying that you know people largely treated some sort of checklist. I think that's so surprising. I mean, I think many many security teams today are, you know, overburdened and overwhelmed. Just in terms of you know, priorities and sheer number of tools that they have to work with.

B

Right I mean yeah, and so you, even you know five six years ago, like when container security was starting to become a thing like you know, people were like, oh, but it's like down here on on my list, but.

A

But increasingly.

B

Like you know, it's now bubbling up to one of the top priorities, just because I think of like the tremendous adoption of you know, kube and cloud native workloads.

A

Yeah- and you know if, if my container file means so much and if my kubernetes artifacts mean so much, then they need to be checked for everything just like my code is right like, but we have to put in kubernetes tooling to do that. It feels like, and some of that tooling can easily be plugged in and some of it is harder to plug in than others right, like we've gone through a couple. Generations of you know digital transformation as people call it.

A

These days, um like you know, there's still the the legacy tooling that folks have to have there's some newer stuff and then there's some cloud native stuff and like making that pipeline.

A

You know the same, for everybody is hard, um so that I mean having the pipeline first is step, one I feel like and then plugging every one and everybody into it at step. Two, if I mean if I could change a developer's mind about you know how important their security team is during this conversation, I think that'd be great, um because if not right, like you, can't possibly know everything about about anything right like unless your you know.

A

Subject matter is you know very small you're not going to be able to understand. You know the underpinnings of kubernetes and like this fcd vulnerability that just you know, got zero date by somebody um like you're, not going to get feedback on that. If you don't know about it, so continuous.

B

A

Is a part of it too, but so, like your tools, need to be continually educated as well. I'm kind of curious, you know, with q blender and, with you know, advanced container security for kubernetes. You know like how: how are those rules added? Where do we source things from and no there was not an actual sed zero day. I was just using that as an example. I'm sorry, sorry to scare people my bad chat. um No, there was not an cd zero day. I was just using that as an example.

A

Right, like you, might find out about it just in time to save your systems or.

B

A

Might not um like you've got to have automated security right and that's my biggest push right, like plugging the people in getting things automated and constantly scanning, and you know remediating things, so you know that's why the get ops guy to the galaxy is up next after this call her show so yeah right like thinking in that you know kind of get ops philosophy.

A

uh Sorry, uh I did scare people um looking at it from like a real time threat, detection perspective, where, where does acs sources rules from how do we? You know? How does acs do that? Real-Time detection? What kinds of things are in place to make that happen? Sure.

B

So I mean a couple things on just what you said too. I mean, like you, introduce a new platform, that's as complex, as you know, kubernetes like you, know, you're going to you're going to introduce things like new vulnerabilities in, like you know the cd thing aside, I mean like that. There have been like you know, critical or important.

B

You know new vulnerabilities in kubernetes that have been discovered and disclosed and managed by the compute community and and all of that, but I think, like part of the answer aside from automation, is like delivering some of these capabilities. You know via the platform right you know, and so so take take openshift as an example, because of course you know we're red hat, but it's just like and even before acs right. You know it's like you could deliver a secure platform and you could surface those things or you could you know better protect.

B

You know organizations from some of these things by baking in the security capabilities into the platform you know from from the beginning, and then you know how we think about is like layering acs. You know on top, and so you know some among other areas. You know one is like you know, threat, detection and sort of asking about that, and you know I think for for us. You know I'll talk about.

B

You know: threat, detection and policies, but, like we've built you know, our platform to you know be extensible and accommodate, for you know, scenarios where new things are going to arise and so and and in some cases like you know, it's going to be specific to your particular environment, and so where we started is you know we wanted to gain sort of like a source of truth? You know for the data that underpins like threat detection. You know, and I think the rel you know there's other folks in the ecosystem have thought about it.

B

Similarly, but I think that it's a relatively new newer approach, you know- and it's enabled by containers, because you know it's less noisy, like containers doing a specific thing. You have a better idea of what you know what you're going to do, and so, when you look at things like system level, data like you know, system calls, and you know, network traffic and things like that. You have a very specific idea of like what a container a microservice or whatever supposed to do.

B

You can even correlate that back to like what you know the manifesto image you know specified and then you can look at things like you know what process executed, like what network request was made like all of that and like that, all helps like inform like better and better. You know, uh threat, detection right and then, in terms of, like kind of you know both detection and policies. I mean, like you know.

B

This is where I think a community can can really really help, because you know more people can contribute and surface and identify issues that just much harder for you know any single organization. You know to be able to do, and so you know this is where, like. If a new you know, coup vulnerability is surface, then you know we'll we'll.

B

You know we'll add that um if there's a new sort of best practice, that's articulated by a sig or or you know other you know, member of the community, we'll look at that and add that, and so you know- and we look to do that- you know because you know we're in close collaboration with folks.

B

But at you know, at the same time, like you know, we want to you know, release that to our you know our our user base as quickly as possible, but I do think like sort of the openness and community approach has a big you know hand in facilitating and enabling you know, sort of like being more responsive and proactively identifying issues that you know. I think individual vendors by themselves.

B

It would have a harder time doing right.

A

Okay, so you're, uh let's see, let me read your title again, never mind um you're too so you're a senior director type and uh this question just came in via chat, and I kind of want your take on it before I respond.

A

um Russia is using kubernetes clusters for brute force, attacks does cncf and or red hat, and I would assume google have methods of preventing kubernetes and open shift to be used for malicious intent.

B

Well, I I I think, that's probably beyond the scope of you know, simply what I can answer, but what likewise you know I mean, what I would say is I think red hat has been very straightforward in terms of you know, an entire entitlement model that you know lets you know. Customer lets end users utilize its software and part of that is complying with. You know certain terms and conditions, and so I'm going to defer kind of on you know some kind of you know definitive answer to that.

B

But to me it seems, like uh you know, uh very plausible, or you know that it falls outside that scope, but I mean we definitely have a very open and straightforward model in terms of how we want. You know um what we allow our, how we allow our software to and not to be used.

A

Right, like at red hat, yes, we do have minimal control of licensing, but that doesn't necessarily mean that it's not going to be running right, like it's just invalid right.

B

Yeah support for.

A

It I mean we can't put back doors in software folks. We can't it's not, in my opinion, a wise decision. Now somebody can differ from me and that opinion and that's fine, that's your opinion, but uh no, we do not have a way of having some. You know, kill switch, and you know I've read an article yesterday about samsung having some something in their tvs. If they're stolen, they can, you know, make them inoperable and like that to me right like I'm like, I don't like that. You know.

B

The risk of the risk of being too big brother for you, chris.

A

A little too big brothery, but the chances of that being now that it's out in the known that there that it's there, the chances of that being exploited, are now infinitely higher right, because now people are going to go looking for the kill, switch and start scanning the internet for samsung tvs and start poking it and see what they can do with it. Right like. I would not be surprised if there's a metasploit module for you know, samsung tv's kill switch here in the next couple months.

A

I wouldn't be surprised at all and I don't like the idea of you know, kind of vendors being able to like come in and say nope. You can turn that off now, because.

A

All kinds of things can go wrong in your infrastructure. There always is a human element to it right, no matter what so having that back door or having some you know, process where it's like. Oh, I need to log in and do this one thing perfectly. Every time during your release is destined to be. You know a point of failure of some sort. Either you mess up a flag or you find some other. You know foul up in your process and your release goes bad.

B

Well, this is where I tend to think I mean like you know, timing and transparency are not inconsistent with each other. You know I mean like think about bones and exploits so you understand the threat vector. I mean, there's a reason. Why, like you know those need to be embargoed? Sometimes you know, but but but the intent is you know you, you have you you work with. You know whoever they're, like you know, relevant stakeholders come up with a solution and then you you be thoughtful about how you disclose it.

B

You know, and at least for you know, red hat and you know the broader coup community with you know like their product security committee and things like that. I mean I think you know people have been very thoughtful about how they've approached you know new issues, at least um in you know, in this software platform, but but yeah I mean you know going back to how thing how things are used.

B

um You know, I think, there's an aspect of you know openness, but I I I also think, like you know, um red hat's been thoughtful about how you know we try to. um Historically, you know made it made software available for use and which uses and- and things like that,.

A

um Yeah, so if, if yeah, here's a good question for you, just came off my head. If you were about to sit down with some new hire at xyz company and they were on the security team, what would be some of the things you would talk to them about? As a you know, fresh infosec person right like what would be some of your top talking points there.

B

Well, it's interesting because I think the first thing that stands out is you kind of said, like infosec, right and and for me, like you know, with new hearts everyone you know, I think largely wants to understand kind of like what what's the vision like. What are we trying to the bigger thing we're trying to do here?

B

You know, aside from you, know the next feature or like the next sprint or whatever it might be, and I think you know the vision is really to change how security is operationalized like you know the fact that someone may think of it as infosec.

B

You know, I think, reflects something because I think in these environments you can't be thinking thinking of it as some kind of silo and it's not right really just infosec it's. We talked about devsecops, but it's really sort of like organizationally. You need like a culture, and you need to build that muscle of like you know how you think about security differently, and so that's actually what I would probably spend you know most of my time talking about which is just like you know, for containers for cube for cloud native stuff.

B

Like you know, micro services, like you know, what does security look like like? How is it you know actually different and what's the opportunity there to actually build better security? You know right, you know and then again there's like you know you can talk about it like conceptually, but I think you know we're.

B

You know we're really making that happen via you know an actual platform that you know many many organizations are are running today, um but I think you know new hires, that you know they kind of get like the bigger picture and they want to. You know, get a sense for you know or it's or it's like hey like what do you think about this project like there's this, you know latest open source project like what are your thoughts? Do you think we'd integrate with it like? Do you think we could?

B

You know build on that like how would we fit in, um and I mean I think, that's great, like you know the the fact that you know you could look at the ecosystem today and and point to so many different security related projects that address you know many many different problems. I think it's a testament to like how the community has like innovated in that area. In it. You know in a space that has historically, as you have pointed out, like typically not been very open right.

A

Yeah- and you know, some people think closed source tools are better because well they're closed and you can't see the code. Other people think open source tools are better because you can see everything in the open. um Why would someone rather work with an open source project in europe versus something closed source.

B

Well, you know.

A

Keeping in mind that acs is kind of going through that same process, right yeah.

B

Yeah I mean, I think that that's allowed us to kind of like look at it from from both lenses. You know I mean I, I think that you know my personal opinion is that you know openness. You know fosters more confidence, you know like uh and, ultimately more you know, innovation and a better security posture like you have diversity of voices and thoughts and perspectives. You know you have more eyes on something you can you know surface or think through. You know a security issue. You know more holistically more comprehensively.

B

um You can think about how you you know, go forward and build. You know in a way that you know, can benefit many many organizations um and then the third is like just practicality is, like you know, more stable code, like you know, faster response time like just because you know you're not reliant on your particular set of individuals. So I think it's this notion that, like by being open, you can actually do more.

B

um I've also worked on my share of like closed source projects, and I think where that comes in is just like look, I mean sometimes in most cases to actually like you know, put out these open source projects like you need a sustainable business like you need to be a going concern right, and so um that's where I think you know close source you know is, is definitely relevant and and can make sense, but I think it question key question is more like what is closed and what is open.

B

You know in in in those scenarios- and you know it's it's beyond kind of the subject of like this show, but it's kind of like yeah, if you're building like if you're building a business on top of open source, you're kind of like you know what needs to be open, what should be open? You know what doesn't have to be, and how do you build a business around it.

A

Yeah, that's kind of the hard part right like building a business around an open source project is indeed difficult. uh Red hat has shown success with that, but it's one of the few potentially.

B

A

B

A

Some others don't get me wrong, but it you know red hat forged the way. I guess I mean potentially not trying to sound too bold here, but I mean you mentioned that transparency does make a difference right so being transparent here. What what gets you up in the morning? What what's something? That's uh you enjoy and look forward to in your day here at red hat.

B

A

Or just in the community in general,.

B

Right well on that, that's on that! That's easy! I mean yeah. You know, like my kids, get me up every morning like they pull me out. They literally pull me out of bed. Sometimes so you know and.

A

And physically necessarily but yeah.

B

That works, I guess no, I I I mean you know I, you know we didn't talk too much about the acquisition, but I mean, like you know, I uh I'm thrilled about kind of like what we're doing here. You know with red hat because because I think, like I think the way forward, for you know security for all things cloud native. Is this comprehensive? Like you know, platform that gives you know someone an out of the box secure experience like I, I just it's just too much, you know and too complex to figure out.

B

You know um you know by oneself, and so I think you you need, you know a trusted. You know platform and vendor, like you know supporting you, you know in kind of wherever you are in that journey. You know to you, know, accomplishing stuff with cloud native software and to me I think that that's you know a mission that you know I find very imp, impactful and something that excites me and in some ways I think, like you know, the vision for for our team has not changed. You know with the acquisition.

B

I think we've been able to do more, you know by you, know, teaming up, and you know joining forces with red hat, and so that's kind of how how I thought about it, but you know, I think, we're still in the early innings of this sort of, like you know, huge shift, paradigm shift in terms of how security is handled, and I think it's really like it was like the catalyst was kube and containers and sort of all these like technical innovations.

B

But I think, like the what's really going to be felt over the years to come, is kind of like you know more time freed up, you know better security productivity, like all all that stuff. That's very, very hard to you, know kind of it's not as concrete as, like. You know, some kind of like technical advancement or something like that.

A

um So what are you excited about? Well, let me ask that question later.

A

What should we be thinking about for the future right like we are in this cloud native space? We are consuming cloud services left and right. Some are sas based. Some are actually like from big hyperscalers.

A

What is what does the future of you know? Security, look like to you, yeah.

B

Especially in kubernetes, you know, I think I think coupe security ultimately is not really about coop right and the re and reason I say that is like you know I mean I think of I mean other people have said this, so I'm I'm co-opting it and I'm not claiming against my own, but I think your people have said. Like you know, kube is a platform you know upon which platforms will be built. You know, and you started to see that right.

B

You started to see that with like service mesh istio and like right dependencies and you know- include cut, you know, custom resources and everything like that, and so I think the way people like actually consume.

B

You know compute and you know, sort of like the abstractions that they run like their apps on, are gonna, be built on coupe, but like who's gonna, be kind of like you know, lower lower in the stack kind of, maybe you know hidden away or abstracted away, and things like that, and so so you know in my mind, I think of things you know moving in the direction you know to be higher and higher level.

B

You know- and I think, there's a sort of like notion of security as code, which is like a very general thing, but to me like what that means is like it's simply aligning with like that movement in terms of extractions.

B

It's almost like it's like you know, if you could think of like serverless as, like you know, an operational model where, like you, don't have to worry about all this stuff like there's some kind of like analogous term, you know, maybe you should think about what that is, but, like there's, some kind of analogous term where it's just like security is also going to be abstract because it could be caught. It's going to be codified security.

A

B

A

That wouldn't terrify anybody, um sorry that just popped out, please continue, uh might.

B

Not be able to who knows I I I. I just think that it's it's something where, like it's not going to be, you know if you have, if you've integrated it correctly into the platform. You know day-to-day focus is not going to be on like tuning. Some kind of you know, kernel level component or something like that.

B

Right, like you're gonna, spend you're gonna wanna, you know the user's gonna wanna, specify you know a policy or you know some kind of um artifact that you know captures uh security and codified form and have that you know applied everywhere. So it becomes like a security abstraction that people will interface with.

A

So you know it's funny. You started off that the whole statement of you know what's next in the future, it's like kubernetes gets lower in the stack we build on top of it.

A

That kind of thing and dr richard I cook, um he's known throughout the devops community, devsecops community, you know and as well as he's an anesthesiologist he's, also an incident response person he's kind of like this magician of things, but he has this concept of above the line and below the line and the below the line stuff is where kubernetes is going to live at some some point.

A

Somebody still has to understand that and then build on top of that, but if we can auto like kubernetes, gives us a capability of automation that we haven't had before when you think of it, it being below the line. Now, how do you see us getting there.

B

Yeah I mean I, I think you know there are others out there who have when I think about like below line. You know above the line, especially for security. Like you know, people spouse like shared responsibility and like stuff like that and like I you know, I I think, and it's like there's delineation, which is like infrastructure and applications, but I think the thing is is like that: that's getting that's getting blurred yeah.

A

B

Like I think, I think you know how things evolve over time is you know you end up starting to encompass more and more about your applications and, and the reason is, is because, like the pieces, you know that you're using to run your application, like let's say in a serverless environment like are smaller and smaller, and so you know I I think that you know you start to you take on you know more and more of that and and the line, almost kind of which was sort of like somewhat of an somewhat of an artificial line like ends up going away in, in my mind,.

A

Good point very good point: it does eventually end up going away um or automated it away right. Like yeah, you know we don't have a net scripts anymore. We have system d, there's some automation. There say what you want about systemd. I don't care it's part of the operating system. Now um but, like you know, that's an abstraction and we're not worried so much about stuff below that anymore. We're worried about system d, um but there's going to be more abstractions like that with kubernetes.

A

I think in the future right and you know, of of all the development platforms that people have tried to build over the years. I think kubernetes gives us the the most stable foundation we've had yet uh to do such things. So I'm I'm excited about the future.

A

What are you excited about either next month next quarter next year? What are you most excited about? Why I'm genuinely curious.

B

Well, you know I mean if you're going to point to kind of like you know next couple months, look I'm super excited about kubecon right, you know kubecon and we actually will be at cloud native security day too, but you know just a chance to congregate again and it's kind of this like hybrid event, but it's really great to see you know people being able to like reconvene in person after you know. I think, that's I think that's so important too.

B

For for the community and look I mean like we have a globally distributed community and- and I think one of the great things about being open is that you can connect.

A

B

Wherever you, you know, regardless of wherever you are, but I do think there's something you know special about. You know catching up in you know in person with you know, uh folks, you know who you know have been, who you've built relationships with. You know online offline and being able to do that in person, especially after you know uh last year and a half we've had yeah. So I'm pretty excited about that.

B

You know um uh meeting folks in la and you know seeing familiar faces and again, like you know, talking about uh where we, where we go with security.

A

From here right- and it's been so long since we've sat down and had like that conversation, we might all have very very new stories to tell and share and different perspectives too, compared to the last time we all sat down and talked so I I am also looking forward to kubecon as well. um Is there anything else you feel like? Do you want to talk about cheesecake or not I mean you can normally it's our icebreaker question folks. So, like we asked, you know, cake or pie is cheesecake a cake or a pie.

A

Way's answer is very very you know interesting, I think, but feel free to talk about anything else that you want to bring out.

B

Well, I mean you know since since this is going to be recorded chris, I feel like I should get my response like just on the right or on record right yeah.

A

B

I mean firstly, your cake replying like it's something you know someone with a sweet tooth. You ask like you know like why not both like why why the question, but but but yeah, you know, I mean so I'll, leave it there. But you know I on the cheesecake or pie thing like I'm going with alton brown like it's definitely a pie, yeah, okay, fair enough.

A

B

Gonna say I just say it like definitively like.

A

That okay drop, the mic, walk off, cheesecake is pie and, in my opinion, I'm kind of with you right like doesn't matter. No, I'm not really gonna eat it regardless, but yeah. That's you know it's a thing so way. It's been great. Talking to you is there anything you wanted to mention about the road map for acs or anything coming in the future product, wise yeah.

B

I mean uh anything off top.

A

My head so yeah.

B

Well, you know I mean I I'll I'll. I will you know. Actually, since you give me the option, it will take a just a couple minutes because I think, like you know, since the acquisition a lot of people have asked like you know, uh where are you going like how's the roadmap changed? um You know how you continue to innovate and so a couple things I'll point to like just on you know things we we've been delivering since the acquisition happened, which was in february.

B

um You know we have and we have blogs and resources. You know available about this, but I think like it, uh it's been great to see us you know put out. You know certain capabilities that allow us to tie more into the open shift portfolio.

B

You know we have a acs operator. We have you know vulnerability. Scanning certification for acs now um integrations with parts of openshift. So things like you know compliance operator, integration and things like that. That will give you more seamless and consistent experience across openshift and acs and of course that also you know I'd be remiss if I didn't mentioning that ties into openshift platform plus, which is you know this new bundled offering that um acs is a part of from a from a roadmap perspective. I think you know there's many things to highlight.

B

I think one area I just want to you know call out as um an area that will continue to you know, build into is managed services so yeah, you know azure openshift, you know uh red hat, open shift on aws rosa. um You know, openshift dedicated, you know all those models like. I think you asked about like what security look like in like coop environments and like the hybrid cloud I mean you know getting consistent security.

B

You know whether you're on something like open shift- and you know, rosa era or whatever else you know is- is really important to us, um and so you know that that's going to be a commute area where how people consume acs is going to become easier and easier over time, regardless of whatever environment they're on. But we are on operator hub, so you can take our operator and you know, use us today and.

A

B

Would love to hear your feedback.

A

Exactly all right wait! Thank you. So much for coming on um really appreciate your time today. Thank you, everybody for tuning in that tuned in live. Thank you for watching this. After the fact, if you're watching it later, um it was great talking to you today, don't be a stranger we'll uh we'll meet up at cubecon, maybe have another conversation. How about.

B

That, likewise, it's great being on chris thanks so much again, thank you.

A

Very much appreciate it.

A