DevSecOps meets GitOps with Twistlock and Weaveworks

Today’s enterprises are tasked with building and deploying modern applications more quickly than ever before. As they embrace cloud native technologies like containers and Kubernetes for managing their applications, they leverage purpose-built platforms designed for efficiency and security.

Twistlock and Weaveworks partnered up to present this webinar that shows you how you can increase reliability and velocity through implementing a GitOps model while keeping an eye on vulnerabilities and compliance through DevSecOps best practices.

Transcript

2. TWISTLOCK | © 2018 | Confidential Keith Mokris Leads product marketing at Twistlock with previous security experience in the mobile app security space. Based in Portland, OR. Avid photographer. @keithmokris
3. TWISTLOCK | © 2018 | Confidential Gain visibility Deploy higher quality code Avoid security incidents in production Control what can and can’t progress through your development pipeline. Know exactly what’s in your images and where risk is introduced. Fixing flaws earlier in the software development lifecycle reduces costs and helps your organization avoid costly data breaches and security issues. Tangible benefits of DevSecOps
4. TWISTLOCK | © 2018 | Confidential Steps and tools involved with building, shipping, and running containers BUILD SHIP RUN Developer writes a Dockerfile, which includes a base image, maintainer, run instructions, etc., that is then built into an image. Images are stored in a repository which is used to deploy images to run in environments of your choosing. Teams can run containers in their own data center or on various cloud services like the ones shown here.
5. TWISTLOCK | © 2018 | Confidential Know the source and content of your images 5 Do you know where your containers come from? Are your developers downloading container images and libraries from unknown and potentially harmful sources? Do the containers use third party code that is obsolete or vulnerable?
6. TWISTLOCK | © 2018 | Confidential Eradicate vulnerabilities from your containers 6 Container images are typically built on some base image, which is itself built on top of other base images. A developer may grab a base image and other layers from public third party sources. These images and libraries may contain obsolete or vulnerable code, thereby putting your application at risk.
7. TWISTLOCK | © 2018 | Confidential 7 Would you want this image running in your environment? An example hellonode image using a GitHub tutorial. 270 High Vulnerabilities 900 Medium Vulnerabilities Yeah, no thanks!
8. TWISTLOCK | © 2018 | Confidential Harden your images, containers, daemons, and hosts 8 Implementing the Docker and Kubernetes CIS Benchmarks is essential. Automation provides tremendous benefits. Example checks: • Do not mount sensitive host system directories on containers • Open only needed ports on container • Only allow trusted users to control Docker daemon • Don’t allow secrets in clear text environment variables
9. TWISTLOCK | © 2018 | Confidential Integrating security into your CI/CD pipeline 9 The best place to detect and fix security vulnerabilities is during development and as part of the CI/CD workflow. Use your CI/CD tools to initiate security scans whenever a new image is constructed and publish the results in the native CI/CD console. Twistlock offers the ability to fail a build and set grace periods based on granular policies.
10. TWISTLOCK | © 2018 | Confidential An example with Jenkins 10
11. TWISTLOCK | © 2018 | Confidential 11 Continuously monitor your containers, images, hosts, and registry with Twistlock Vulnerability Explorer Stack-rank highest vulnerabilities correlated with contextual data Examples: Does the container have listening ports? Does is have a security profile applied? Does the vulnerability included remote code execution?
12. TWISTLOCK | © 2018 | Confidential Automate anomaly detection and threat defense in container runtime 12 Containers should be minimal, declarative, and immutable. Those characteristics mean that it is actually possible to build a reliable baseline for the containerized application. Using this baseline in runtime you can detect anomalies and active threats much more accurately than with monolithic applications that change frequently. Automating the baselining process, the detection actions, as well as the enforcement, is the only way to scale up runtime security.
13. TWISTLOCK | © 2018 | Confidential 13 Powerful Runtime Defense with Twistlock Defense-in-depth provides several security layers to protect running applications CNAF, layer 7 firewall, prevents modern network attacks Runtime Defense automatically models each image, container, and host to prevent anomalous activity CNNF, layer 3 firewall, locks down pod-to-pod traffic without any manual work