Compliance in Cloud Native

Let's talk about security controls in Cloud Native environments, a checklist to comply with compliance such as ISO 27001, show tools that will help us in the security journey in the Kubernetes cluster.

Transcript

1. Compliance em Cloud Native Carol Valencia @krol_valencia
2. Carol Valencia Solution Architect in in/carolgv krol3 @krol_valencia @krol_valencia
3. Iso/iec 27001 Information technology - Security techniques - Information security management systems - Requirements @krol_valencia
4. https://www.caveonix.com/solutions/iso/ @krol_valencia
5. https://www.caveonix.com/solutions/iso/ @krol_valencia
6. https://blog.ine.com/13-effective-security-controls-in-microsoft-azure-for-iso-27001-compliance @krol_valencia
7. 7 https://blog.ine.com/what-is-the-goal-of-azure-security Confidentiality - CIA
8. https://blog.ine.com/what-is-the-goal-of-azure-security 8 Integrity - CIA
9. https://blog.ine.com/what-is-the-goal-of-azure-security 9 Availability - CIA
10. A.8 Asset Management @krol_valencia
11. @krol_valencia
12. @krol_valencia
13. A.9 Access Control https://isoconsultantkuwait.com/2019/12/08/iso-270012013-a-9-access-control/ @krol_valencia
14. RBAC https://www.cncf.io/blog/2018/08/01/demystifying-rbac-in-kubernetes/ @krol_valencia
15. Autenticação e Autorização https://theithollow.com/2020/01/21/active-directory-authentication-for-kubernetes-clusters/ @krol_valencia
16. Acesso ao Cluster Kubernetes https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/ @krol_valencia
17. A.10 Criptografia § Use of encryption (only TLS for public communication) § Key Management § Certs in Vault @krol_valencia
18. A.12 Operations Security • Documented Operating Procedures • Event Logging • Management of Technical Vulnerabilities @krol_valencia
19. A.12.1: Operational procedures and responsibilities https://itnext.io/platform-as-code-how-it-compares-with-infrastructure-as-code-and-what-it-enables-2684b348be2e @krol_valencia
20. A.12.4: Logging and Monitoring
21. A.12.5: Integrity of operational systems - Immutable Infrastructure • No SSH on workers • Build from scratch on every update - Rolling redeploy every week with newest K8s
22. A.12.6: Technical Vulnerability Management - Explicit configured sync from selected public docker images only - Update Checker for system components - Planned: Container Image Scanning https://github.com/aquasecurity/trivy/ @krol_valencia
23. A.13 Communications Security https://itnext.io/how-to-kubernetes-cluster-network-security-f19bc99161f5 @krol_valencia
24. NETWORK POLICY USANDO OPA https://www.magalix.com/blog/how-to-enforce-kubernetes-network-security-policies-using-opa @krol_valencia
25. https://blog.aquasec.com/istio-kubernetes-security-zero-trust-networking @krol_valencia
26. A.14 System Acquisition, Development & Maintenance https://holisticsecurity.io/2020/02/10/security-along-the-container-based-sdlc @krol_valencia
27. A.17 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY MANAGEMENT https://www.rancher.co.jp/docs/rke/latest/en/etcd-snapshots/example-scenarios/ - High availability - Backup & Recovery @krol_valencia
28. A.17 Information Security Aspects of Business Continuity Management https://velero.io/ @krol_valencia
29. A.17 Information Security Aspects of Business Continuity Management - High availability - Backup & Recovery https://banzaicloud.com/blog/etcd-multi/ @krol_valencia
30. A.17 Information Security Aspects of Business Continuity Management - High availability - Backup & Recovery https://banzaicloud.com/blog/etcd-multi/ @krol_valencia
31. CIS Benchmark - CIS Benchmark Linux - CIS Benchmark Docker - CIS Benchmark Kubernetes https://github.com/aquasecurity/kube-bench @krol_valencia
32. Pentesting em Kubernetes https://github.com/aquasecurity/kube-hunter @krol_valencia
33. CSPM - Cloud Secure Posture Management https://github.com/aquasecurity/cloudsploit @krol_valencia
34. References - KubeSec: https://kubesec.aquasec.com/enterprise_online_series - Iso 27001: https://www.isms.online/iso-27001 - Disaster Recovery: https://www.altoros.com/blog/enabling-high-availability-and-disaster- recovery-in-kubernetes - https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/get-started - Cryptografia - Casa Hacker: https://www.youtube.com/watch?v=9CoQpGt6aAg&feature=em-lbrm @krol_valencia