Red Hat OpenShift Security | OpenShift, 26 Apr 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: What’s Next for Red Hat Advanced Cluster Security (Q1)

Description

In this 25 minute session, you'll receive a brief overview of Red Hat Advanced Cluster Security, understand the vision for managing Kubernetes and container security, learn about recent RHACS updates, and receive a roadmap update for both near term and long term priorities.

A

Kirsten newcomer: hello, everyone. welcome to the red hat advanced cluster security roadmap, session.

A

I'm joined today by the red hat acs product management, team.

A

I'm kirsten newcomer., I'm also joined with jamie scott,, doron caspin, shubha.

A

Bahdve and nirmol singh kaur. our agenda today, we're here to talk to you about we're, going to introduce red.

A

Hat acs in case you're, not familiar., we'll share our vision for managing kubernetes and containers. Security.

A

We'll also share a little bit about. What's what we've done recently in red.

A

Hat acs, and finally spend most of our time talking about the roadmap priorities.

A

Near term and longer term jamie., please take it away.

B

Jamie scott:, so over the last few years, we've seen a trend.

B

Teams need to do more with less.

B

and what that's really resulted in is kubernetes becoming the standard.

B

For application, innovation teams are delivering microservices.

B

They're working toward declarative architecture and they're working.

B

Toward a mutable infrastructure.

B

and what that's really resulted in is kubernetes adopted.

B

Hockey, sticking and cloud services becoming part of.

B

The standard of innovation.

B

and as kubernetes and cloud services become more and more important to the.

B

Industry, kubernetes native security has become increasingly critical.

B

And that's what acs does today.

B

acs helps you to secure your supply, chain,, secure infrastructure.

B

And secure your workloads. as teams look to develop a more developer centric in dev sec, ops,.

B

Operating model for applications.

B

next slide., so we've asked ourselves these questions and we've talked to many customers and.

B

We've found that successful security programs really come with a few key.

B

Attributes teams want faster time to resolution vulnerabilities and security.

B

Misconfigurations are ultimately an expense center for the organization.

B

And in order to reduce the cost of that expensive to center,, people need.

B

Faster time to resolution of issues., they also need to break cross-functional barriers within the organization, security.

B

Teams, development, teams, and platform sres all generally speak a different.

B

Language and teams need to bridge that cross-functional barrier in order to be.

B

More successful in their collaboration.

B

and finally, there's a large skill gap in the industry and a large context.

B

Gap developers and security people.

B

It's unreasonable to expect them to know everything.

B

The developer needs to stay on top of technology,, but can't know.

B

The ins and outs of security.

B

and meanwhile,: it's not reasonable to expect a security person or security.

B

Engineer to know every technology., so there's a skill and context gap that as organizations scale, means to be.

B

So how do we do this? well, in order to deliver value beyond protection,? We need to.

B

Solve these three problems. and first is faster time to resolution. In order to do that,, we need more.

B

Effective prioritization workflows.

B

we need to create feedback loops early and often between development teams.

B

And we need to improve data quality and remediation guidance in order to help.

B

Developers fix issues as effectively as.

B

We need to break cross-functional barriers to do that.

B

We need to provide guidance to teams and the tools that they use every day.

B

We can't expect developers to shift out of their workspace into a security.

B

Tool, and we can't expect security teams to shift into different tool, sets.

B

They needed this information and they needed in a common workspace that they log into.

B

We also need to enable collaboration between these stakeholders.

B

That means we need to create a common language for each of them.

B

And that common language for kubernetes is different for each organization.

B

We need to break that skill,, that barrier of language.

B

Finally,, we need to design security enforcements to minimize outages in a.

B

Way that developers can design around in order for a security enforcement action,.

B

Never to actually break an application, because that ultimately will result in a.

B

Business impact and financial loss of now.

B

So finally, we need to really address the skill and context gap within our industry.

B

And in order to do that,, we need to simplify the adoption of security.

B

Practices with standard patterns, for developers and security teams that.

B

Provide guardrails for each organization..

B

We need to mature incident response capabilities without of the box. Policies.

B

And we need to enable each and every team to make more informed risk management.

B

Decisions with contextual data in order to help them facilitate those decisions.

B

A

So how does it red hat advanced cluster security help you do this today?.

B

First, we help you with vulnerability management., we scan your images for known vulnerabilities, and we help you to.

B

Enforce policies based on in your ci workflows in order to ensure.

B

That vulnerability, is, are managed appropriately for organizational.

B

We need to help teams with configuration management and that's what red hat.

B

Advanced cluster security does., we identify configuration risk ranging from common misconfigurations to,, even.

B

To the ability to look at kubernetes are back and we help developers.

B

Look for misconfigurations in their deployment yamls in order to help.

B

Facilitate and accelerate their security checks throughout their organization.

B

We also help teams with compliance and network segmentation.

B

We help compliance teams to align with industry standard frameworks and give them.

B

Insight into their compliance posture., and we also allow teams to audit and recommend network policies in.

B

Order to help facilitate network segmentation across the industry.

B

One of our core use cases is risk profile.

B

That enables teams to focus on the most risky deployments in their environment.

B

So that they can focus their energy on tasks that would have an outsized.

B

Impact on their security, posture. overall,, then. Finally, there would be no security tool if it didn't have.

B

Run time, detection and response., so we help teams to identify deviations from known good activity.

B

And to alert on known bad activities such as crypto mining, service.

B

In order to really help them get a pane of glass into the real-time.

B

Threats of their organization.

B

B

So how do we want to involve kubernetes security over time?.

B

So we've done that recently by helping developers,, admins, and.

B

Notification feedback loops.

B

so for developers,, we've streamlined risk management processes by enabling.

B

Teams to look at false positive risk and look at accepted risk and bake.

B

These decisions of this is a false positive,, or this is an accepted risk.

B

Directly into their ci workflows., we've also simplified issue prioritization by bubbling up the most important issues.

B

Directly in the ci, so that developers know what to focus on instantly without.

B

Having to triage through a lot of alerts.

B

For administrators, we've reduced setup, costs.

B

We've done that by simplifying administration of openshift platform,.

B

Plus, to ensure that these teams don't have to set up multiple identity.

B

Providers by using openshift oauth.

B

We also help teams to scale their integration with multiple elastic.

B

Container registries across multiple accounts by supporting assume role using.

B

Aws sts, in order to ensure that teams can have a central pattern for authenticating.

B

Into elastic container registry at scale.

B

And finally, we've shortened our feedback loops greatly.

B

we've done that by scheduling remediation at tasks for vulnerabilities to.

B

The appropriate team, in a way that can continuously inform users of.

B

The most important risks in their.

B

and we've also helped machines and notification workflows for incident.

B

Responders, by giving them additional context for runtime notification.

B

Enhancements by giving their sim the information that it needs in.

B

Order to make more informed risk management decisions when someone's.

B

Manually, triaging and alert.

B

So we want to go through our team and go through each of the key priorities.

B

For red, hat,, advanced cluster security., these key priorities are security, innovation, cloud, services, portfolio.

B

Integration, and open source.

B

So let's talk a bit about security, innovation and shubha,. I and boaz.

B

We'll do just that first for our secops persona.

B

Security posture. kpis are incredibly important..

B

The security individual has about five minutes to go to each of their key stakeholders and inform them what will have and out sized.

B

Impact on their security posture., they only have a limited amount of time., so we want to bubble up the most important kpis and show the trends over time, so that.

B

They can have that conversation,, but also go to their board of directors and say,.

B

This is the return on investment you've had in your kubernetes security program.

B

We also want to help teams to identify inactive software components at.

B

Runtime,, a streamlined remediation workflow can be achieved simply.

B

By removing software packages., if a software package is.

B

use interrupt by a runtime process., that means that teams can simply or move that software package to systematically.

B

Harden their environment,, but also to systematically reduce the cost of.

B

Their vulnerability management program, because they'll never have to go back.

B

And triaged an alert to patch in a vulnerable package that no longer exists.

B

We're also looking to enhance how we do host a vulnerability, scanning.

B

We're getting to do that by extending vulnerability, scanning to more.

B

Host operating systems and provide a consolidated view of known vulnerabilities.

B

Across your cluster, so that you can extend beyond workloads to a holistic.

B

Kubernetes security, posture, vulnerability, management, system, and finally,.

B

We're looking at image signatures and how image signatures and supply chain.

B

Play a role in to a security persona and by validating image signatures,. We.

B

Can help to validate providence of the actual images that are being used to help.

B

Secure your supply chain, more effectively.

B

So another bit of feedback that we continuously get is policy management.

B

Policy management is key for every member of the organization.

B

So we want to help teams to scale that policy management.

B

We're looking at investing in reusable policy resource scopes.

B

In order to help you scale that., so that resource scopes can be easily auditable,, but also different policies.

B

Can be applied to different scopes of resources,, whether that be between.

B

Test and production environments, or between multiple tenants and.

B

Teams within your organization.

B

we're also looking to help developers and platform sres more effectively scale.

B

Policy management and collaborate more effectively with the security team.

B

We're doing that by looking at, git ops policy management and.

B

Providing more intuitive ways and patterns through custom, resources.

B

In order to scale policy management,, we also recognize the value of community.

B

An open policy agent has really become a key community contributor.

B

In the kubernetes space., so we're looking to see ways that we can extract open policy agent,.

B

Where you go and use our dragon drop policy interface, so that we can bridge.

B

The skill gap,, but also collaborate with the community in order to.

B

To ensure that teams have,, who already have invested in an open policy agent,.

B

Can easily use those and drag and drop them between as they transition to red.

B

Hat, advanced cluster security,, but also, so that red hat or advanced cluster.

B

Security can contribute back to that.

B

and finally, we're looking to enhance our policy management workflows by.

B

Streamlining that workflow for creation of policies and risks and editing, workflows.

B

Within our policy management system.- and I want to hand over to shubha to ensure that talk about workload.

B

Vulnerabilities, our investments there.

C

Shubha badve: thank you, jamie., now switching gears to vulnerability management..

C

I think we all can agree that vulnerability management is a crucial.

C

And an integrated part of devsecops.

C

Keeping that in mind, we are constantly innovating in this space.

C

And making the acs features more rich.

C

One such feature we would like to introduce this year is local.

C

Image scanning for our developers., in line with industry's shift-left approach to security.

C

We want to enable developers to scan their images on their local systems so that.

C

They can eliminate vulnerabilities faster and earlier in the development process.

C

We intend to have a version of acs scanner that they can install on.

C

Their local system for local image scanning, the results will be stored.

C

Locally and then sent to an acs deployment for vulnerability, matching.

C

We are also looking to enhance in the area of acs registry integration.

C

With the upcoming release of acs three dot, six, nine acs.

C

Now we'll be able to scan images which are hosted in internal image registry.

C

For openshift,, as you know, openshift internal image registry is only accessible.

C

From within the openshift cluster- and there is no external access, to.

C

We are also looking to enhance integration, registry.

C

Integration with ecr., we want to automate the registry integration process for amazon.

C

Elastic container registry. for those of you who use aws by doing so,, we want to improve the scalability.

C

As well as achieve a seamless integration, we also want to enhance the.

C

Radiation guidance to our developers by providing them additional information.

C

To triage detected vulnerabilities.

C

for example,, if a package is detected vulnerable,, we want to be able to tell.

C

To the developer, whether that package comes from the base, image, layer, or.

C

Does it come from the application layer?

C

if it comes from the base image layer,, the developers can look at the team.

C

Who maintains those standardized base? Images for remediation.

C

But however,, if the package is in the application layer,, then the responsibility.

C

For remediation falls on the update teams.

C

And that's all I have handing it back to boaz.

C

Boaz michaely: thanks shubha the next areas of security, innovation,.

D

Our compliance and network policy, management, meetings, security and.

D

Regular queue compliance requirements is a key use case for that acs, customers.

D

Red hat, advanced cluster of security, includes out of the box compliance.

D

Policies for workloads and kubernetes, and it integrates with the openshift.

D

Compliance operator to extend compliance assessments throughout the stack.

D

We plan to introduce a brand new graphical,, seamless user.

D

Experience that better combines., the two sets of capabilities users will be able to schedule.

D

Compliance operator scans. using an acs, intuitive wizard users, will be able to customize.

D

Compliance profiles to meet local and individual regulation needs.

D

And for a better streamlined workflow,, the product will present both infrastructure.

D

And workload scan results in the same view,. Red hat acs already provide some.

D

Compliance scans for eks,, aks and gke,, including cis docker,, pci,, dss, and hipaa.

D

We will be extending those capabilities by supporting the compliance operator.

D

On these three additional coordinators, distribution,, starting with eks.

D

We will also deliver a profile for the cis benchmark for amazon elastic,.

D

Kubernetes service or clusters.

D

Kubernetes network policies are vital in helping to enable zero.

D

Trust networking within kubernetes.

D

They reduce the impact of network attacks by limiting the.

D

Opportunity for lateral, movement.

D

applying network policies is a recommended best practice. Is, was.

D

Also included in the kubernedes hardening guide, published by nsac.

D

So yet most organizations find it challenging to implement.

D

Kubernetes network policies,, unless they are kubernetes experts.

D

Red hat acs already helps by providing visualizations of pod.

D

To pod communications, and by providing automated recommendations.

D

For tightening network policies., this is particularly useful in providing visibility to network security, teams.

D

We are continuing to invest in this space to help organizations take.

D

Advantage of this important technology.

D

first,, we plan to ship an acs policy that will check for proper existence.

D

Of network policies across all names.

D

Second,, we want to make it easier for users to get started by leveraging.

D

A recommended network policy., we plan to compliment the runtime live traffic analysis available today with.

D

An analysis of declarative resources that can be done prior to development.

D

This will allow developers to benefit from these recommendations during.

D

The development stage and to try out recommended network policies during that.

D

Third,, we're planning to add an intuitive point and click visual editor.

D

Side-By-Side with the yaml editor,, allowing users to select allowing.

D

Block connections with no need to understand the underlying yaml code.

D

At the same time., this offers an opportunity for developers to get acquainted.

D

With network policy yaml. when they're interested, combined, these tips, help.

D

Organizations to shift security.

D

and more easily defined, deploy and manage kubernetes network.

D

Policies in a collaborative fashion.

D

We're also planning several improvements to the network. Graph.

D

First, to support large-scale deployments with hundreds of clusters and thousands of.

D

Applications, users will be able to limit the scope to namespaces they care about.

D

And visualize connections relevant to those namespaces only next we're planning.

D

To further enhance the user expects.

D

by helping users quickly identify problem areas and drill down to.

D

Isolate and remediate issues.

D

as part of that, we're planning to add visibility of additional information.

D

Associated with network connections, such as which processes listening on.

D

What port and with that over to doron.

E

Doron caspin: thanks boaz.. So let's talk about cloud services.

E

so, this year is marks as a year for cloud services in red hat and it's.

E

All part of the of transferring a it services and establish a cloud.

E

Strategy for the company and the.

E

Covid pandemic established and the cloud as a strategic tool for.

E

Providing ha platform to develop solution faster with no capital expense.

E

Expensive for the it infrastructure.

E

the journey to the cloud is even more important for business.

E

Today is the face down to be unpredictable operation impact of the pandemic.

E

Based on that rather decided that we want, we want this year and and next.

E

Year's to invest in managed services and acs managed services is part. Of.

E

So acs managed services,. We provide the capability to launch the product.

E

They acs product, a advanced cluster security product within minutes.

E

So we, you sign up online and you can pay online.

E

You can put your, eh, use a use, any any marketplace to buy acs.

E

And in 15 minutes, you will have a environment that you can use to.

E

Protect your kubernetes environment and with security and resiliency.

E

That meets your requirements.

E

The regulatory requirement, acs eh, cloud services will allow you.

E

To start protecting the kubernetes deployment within minutes with building.

E

Kubernetes native security and.

E

Features that provide insight into critical vulnerabilities and fed.

E

Vectors, but all the, all the features that was described earlier with my, by.

E

My colleagues, we flexible consumption option customer will be able to use a.

E

Pay-As-You-Go model of, or use their committed, spent to buy acs on a.

E

Managed services on red hat, marketplace,, aws, marketplace, and azure market.

E

Back to kirsten kirsten newcomer: thanks so much doron. So for those of you who are.

A

Using red hat acs with openshift,, we wanted to share a little bit of.

A

Information about more things that we'll be doing to improve the portfolio.

A

The integration with openshift, as was noted, earlier,. Of course you.

A

Can use acs with eks,, gke, or aks, and we're really looking forward.

A

To the, as a service offering., also making it. for those, for those of you using those group platforms to take.

A

Advantage of red hat acs,, so openshift platform,, plus an option.

A

Available to our openshift customers., those are using openshift.. You can get openshift plus advanced cluster security, advanced.

A

Cluster management and red hat quay for your global registry.

A

So when we talk about the portfolio integration,, these are the areas.

A

Of integration that we're looking.

A

shubha mentioned earlier, that we are actively working or we'll be.

A

Releasing soon, the ability to scan the openshift local registry.

A

We're also working to integrate the experience that our end users have our.

A

Customers have when they're working with both advanced cluster security and.

A

Advanced cluster management,, we anticipate providing a security perspective.

A

In the openshift console.

A

jamie mentioned the ability already available to reuse the open shift.

A

Auth providers, same identity provider across open shift in acm and acs.

A

We'll be expanding that to have a ui for aca.

A

And acs with a security perspective, right in the console, so that you.

A

Can see all your compliance policies and postures across the fleet.

A

Similarly, we'll be exploring what we can do for visibility and management.

A

Of cross cluster networking. multi cluster mesh support is on the openshift roadmap.

A

And this is a place where acs will expand its security capabilities.

A

As well around network security.

A

and then finally, we're also looking to consolidate the acs scanner and.

A

The clare scanner,, so that you have a common experience across acs and.

A

Next, we wanted to talk a little bit about community projects.

A

So we'll be by the time you see this,, we will likely have announced that.

A

Stackrox code is fully open, source.

A

The upstream project for stackrox is in fact,, stackrox.io will be putting.

A

A lot of energy into that community., looking forward to community support and interaction across our.

A

Colleagues who care about container.

A

and kubernetes security in the open source, community.

A

Again, we'll be consolidating our scanning capabilities into.

A

The clair open source project.

A

jamie,, you know,. We will also be focusing on providing more.

A

Capabilities in the kubelinter project., this kubelinter open source project is.

A

Available to you to use today to analyze helm, charts for excess.

A

Privilege, things like that., we'll be expanding, extending the capabilities of that.

A

Project to kubernetes operators.

A

similarly,, we're looking, we're already collaborating with the cncf.

A

Falco project and we'll continue to do additional open-source contributions.

A

There from the red hat acs, code.

A

Finally, we just have kind of a quick acs roadmap as at a glance just to.

A

Give you that one shot overview.

A

And with that,, we wanted to say thank you, there's information here about how you.

A

Can find more information from red, hats.

A

And we look forward to talking with you again.