360° Kubernetes Security: From Source Code to K8s Configuration Security

Company Confidential & Proprietary
360° Kubernetes Security:
From Source Code to
K8s Configuration Security
Shiri Arad Ivtsan, Senior Product Manager at WhiteSource
Yaniv Peleg Tsabari, Product Manager at Alcide

about# yaniv.peleg.tsabari
--from tel_aviv
--enjoy running,swimming baking
bread
--engineering @ECI Telecom
--product @Imperva
--product @alcide
--linkedIn Yaniv Peleg Tsabari
run
about# shiri.arad.ivtsan
--from givatayim
--enjoy reading, yoga,
pilates
--Former_CSM @Spotinst
--product @Whitesource
--podcaster @Mozzarella
--linkedIn Shiri Arad Ivtsan
run
Shiri Arad Ivtsan
Meet Shiri and Yaniv

The Agenda
▪ Open Source Usage Summary
▪ Handling Vulnerabilities The Common Way
▪ Best Practices for Handling Vulnerabilities
▪ Alcide Overview - Drivers for Kubernetes security
▪ Kubernetes Dev to production security building blocks
▪ Alcide Advisor - Continuous K8s Security from Cluster Hygiene
to Drift Prevention
▪ Alcide Advisor short demo
▪ Q&A

Company Confidential & ProprietaryCompany Confidential & Proprietary
96.8%
of developers rely on open
source components
Frequency of Use of Open Source Components

80% of the Code Base is Open Source Components
5%-10%
1998
30%-50%
2008
60%-80%
2016
Proprietary Code
Open Source Code
Source: North Bridge Future Of Open Source Survey
Open Source Code
Proprietary Code

The Number of Reported Vulnerabilities is Rising

of all reported vulnerabilities have at
least one suggested fix in the open
source community
97.4%
The rise in awareness also led to a
sharp rise in suggested fixes…
But it’s not all bad..

Information about vulnerabilities is scattered
across hundreds of resources, usually poorly
indexed and therefore unsearchable
OF REPORTED OPEN SOURCE
VULNERABILITIES APPEAR
IN THE CVE DATABASE
86%OVER

Detect Issues As Early As Possible

Handling Security
Vulnerabilities
The Common Way

The Common Way of Handling Security Vulnerabilities
Security teams
analyze and
prioritize
vulnerabilities
Sending emails or
opening
issues/tickets
Closing the loop on
resolution is hard

The Common Way of Handling Security Vulnerabilities
Security DevOps Developers
Bridging the Gap is a Must

How to Bake Security
Into Existing Workflows

Containers: Software Development Lifecycle

▪ Scans the entire cluster as a baseline for future
changes
▪ Visibility of libraries, images, alerts and
vulnerabilities
▪ Tracks changes in the cluster
▪ Scans the container images and reports cluster
security-related information
▪ Designated reports and dashboards
Orchestration Controller

▪ Get a baseline of resources in the cluster, including all open source
components
▪ Include/Exclude specific resources from the scan
▪ Adjust performance limits: parallel resources scanned
Initial Scan

Real-Time Alerts for Vulnerabilities
▪ Get automated alerts for vulnerabilities, upon new
resource deployment
▪ Get alerts for new vulnerabilities in existing resources

▪ Configurable way to enforce security policies as a final gate before
production
▪ The controller uses Kubernetes built-in admission controller to
reject vulnerable resources
Enforcement

Keep your
Kubernetes Cluster
Secure

Copyright ©2019 Alcide.io, All Rights Reserved
Kubernetes Security Surface
20
More Than Just Dockers and Images

21
Docker/Image Security

22
Cluster Hygiene with Alcide Advisor and WhiteSource

Access to VMs
Access vis K8s API or Proxy
Access to etcd API
Intercept/manipulate control
traffic
Intercept/manipulate app
traffic
Espace
container/pod to
host
Cluster
The Kubernetes Attack Surface

K8s, Like All Software, Isn’t Immune to Security Issues
Metadata DNS IAM

Alcide Continuous Security from Dev-to-Production
25
Ensuring the Security of Kubernetes & Istio based Applications. Continuously.

Code Build Deploy Test Release Test Operate Test
Snapshot of Cluster’s
Risks & Hygiene
Drift PreventionDetecting Hygiene Drifts /
1
2 3
Harden Production Environment By Shifting-Left and
Resolving Security Issues in Development Stage

App Formation
Learn & Enforce cluster deployed
components
Network Policies
Kubernetes network policies
Alcide embedded policies
Secret Hunting
ConfigMaps
Pod environments variables
RBAC permissions for Secret objects
Pod Security
Security context
Pod Security policy
Host volume mounts blacklists
Vulnerabilities Scan
Kubernetes vulnerabilities scan on
the master API server and worker
node components. Istio Control
Plane CVE scan.
Ingress Controllers
Scan Ingress controllers for
security best practices
K8S Operators
Scan etcd and prometheus
operators for security best
practices
Istio Security
Istio security configuration and
best practices
Workload Conformance
Validate labeling scheme
Validate annotation scheme
Validate readiness/liveness
probes exist
Validate cpu & memory limits
defined
K8S Dashboard
Kubernetes Dashboard security
checks
Service Resources
Scan Service resources for
hardening best practice
Registry Whitelist
Container image name and tags
Supply chain validation against
whitelist
Admission Control
Enforce policy at resource
admission time
Drift prevention
K8S CIS Benchmark
Scan Kubernetes nodes against
CIS benchmark
K8S API Server
Kubernetes API Server access
privileges checks
Alcide Advisor
What Can You Scan?!

Am I Pulling Software from Authorized Image Registries?
28
Cluster Hygiene with Alcide Advisor in CI+CD

Alcide Advisor: Key Takeaways
￫ Ramping up your K8s environment quickly while reducing security
risks
￫ Agile Security - IN // Security vs agility OUT
￫ One platform for collaboration: connecting security and DevOps

Q & A

Thank you!
www.whitesourcesoftware.com
Alcide.io

360° Kubernetes Security: From Source Code to K8s Configuration Security

More Related Content

What's hot

Similar to 360° Kubernetes Security: From Source Code to K8s Configuration Security

More from DevOps.com

Recently uploaded

360° Kubernetes Security: From Source Code to K8s Configuration Security