Cloud Native - Security threat or opportunity

Keynote at Velocity London in which I make the case that it's easier to secure a cloud native deployment than a traditional one.

Transcript

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. Cloud Native - security threat or opportunity? Liz Rice @lizrice | @aquasecteam
2. 2 @lizrice What is Cloud Native? Containers ◼ Orchestration ◼ Microservices
3. 3 @lizrice Orchestrated, containerized microservices Hundreds of microservices Thousands of containers Average container lifetime < 1 day
4. 4 @lizrice Security is a concern when deploying containers 88% agree Sonatype 2017 DevSecOps Survey
5. 5 @lizrice Before Cloud Native Create software Deploy Patch Provision servers
6. 6 @lizrice Through 2020, zero-day vulnerabilities will play a role in less than 0.1% of attacks Source: Gartner 7 Top Security Predictions for 2017
7. 7 @lizrice Applying patches to containers?
8. 8 @lizrice
9. 9 @lizrice Cloud native process Create software Build images Deploy
10. 10 @lizrice Scan for vulnerabilities Create software Build images Deploy
11. 11 @lizrice Image policies Create software Build images Deploy ✓ ✓
12. 12 @lizrice What about the hosts?
13. 13 @lizrice Hosts Host OS Automated testing Recycling Intrusion detection
14. 14 @lizrice Wait, there’s more!
15. 15 @lizrice Microservice network segmentation ▪ Restrict communication between microservices ▪ Encrypted connections
16. 16 @lizrice Runtime protection ▪ Restrict container activity ▪ Prevent anomalous / suspicious behaviour
17. Shellshock demo
18. 18 @lizrice Cloud Native security advantages ▪ Decomposition of the problem ▪ Additional layers of defence ▪ Continuous deployment ▪ Shorter attack window ▪ Community best practices
19. 19 @lizrice Room for improvement in container security 80% agree Aqua Security 2017 Survey
20. 20 @lizrice “Containers … require a more collaborative approach by security and DevOps teams.” Source: Gartner 7 Top Security Predictions for 2017
21. 21 @lizrice “Organizations would do well to embed security early into the process” Source: Gartner 7 Top Security Predictions for 2017
22. 22 @lizrice Continuous integration Continuous deployment Continuous security
23. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. @lizrice | @aquasecteam aquasec.com/survey github.com/aquasecurity/kube-bench