2019 CISO Leadership Forum: Security 3.0 – Shifting to Automation

Transcript

2. | © 2019 | Confidential Software is eating the world Every org is becoming a software org Software orgs need modern tools DevOps, containers, and cloud native are those tools The world is dangerous ‘Democratization’ of sophisticated attacks Security teams and SOCs overloaded Your own software is the softest target
3. | © 2019 | Confidential Think about your cloud native infrastructure… it’s abstraction on top of abstraction, especially from a networking standpoint Everything is ephemeral and everything is constantly changing — many more entities to secure Security is largely in the hands of the developer Security needs to be as portable as the applications Cloud Native Makes It Harder...
4. | © 2019 | Confidential The nature of cloud native applications allows for a new approach to security Apply machine learning to understand actual runtime behavior Build models of what applications should do to detect and prevent what they shouldn’t …But Also Easier
5. | © 2019 | Confidential Today’s Orgs Have More Infrastructure Options Than Ever Before
6. | © 2019 | Confidential Real World Risks from the Past Two Years Weight Watchers IT infrastructure exposed via no-password Kubernetes server Kubernetes' first major security hole discovered, allowing privilege escalation, with a CVSS 9.8 February 2018 May 2018 June 2018 December 2018 SSRF in Shopify Exchange leads to root access in all containers Tesla cloud resources are hacked to run cryptocurrency mining malware RunC container escape flaw enables root access to host system February 2019 And last week, Twistlock Labs disclosed a directory traversal vulnerability in kubectl
7. | © 2019 | Confidential With the right approach, this new world is more secure.
8. | © 2019 | Confidential Enabling Better Defense The nature of cloud native technologies allows for a new approach to security Machine learning and automation take manual configuration out of the picture Whitelist what applications should do to detect and prevent what they shouldn’t 8
9. | © 2019 | Confidential New World Security Shift security left – modeling integrated into CI/CD Policy custom tailored for each application, each build Security that automatically scales with the environment 9