Uploaded bylior mazor
Application security meetup k8_s security with zero trust_29072021
The document discusses Kubernetes (k8s) security, emphasizing the need for both posture and runtime protection in the release cycle to mitigate risks and ensure compliance. Organizations face challenges such as misconfigurations, visibility issues, and threat management, while ARMO offers solutions to improve k8s security by integrating visibility and control throughout the workload. It highlights the importance of managing open-source dependencies due to vulnerabilities, providing guidance on risk management for software supply chains.
More Related Content
Similar to Application security meetup k8_s security with zero trust_29072021
![Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/apachesparkgettingstarted-260203175547-8361bcc3-thumbnail.jpg?width=640&height=640&fit=bounds)
Application security meetup k8_s security with zero trust_29072021
- 2.
- 3. APPLICATION RELEASE CYCLE SecurityAssessment
- 4. K8S WHO, WHYAND HOW? How often are you release cycles? What role at your organization is most responsible for container and Kubernetes security?
- 5. K8S WHO, WHYAND HOW? • Compliance is a priority • Lack of K8s knowledge, uses: • Network security (NGFW) for North- South sanitation • WAF/API gateways for application-level vulnerabilities • Willing to purchase a standalone solution for K8s security • Looking for solution that covers A-Z (runtime, posture etc) • Security is not priority • Hates adding tools to his pipeline • Bottle neck in the organization • “Don’t touch my production!” - shift left • Everything is code/API • Visibility is very important, but not as a standalone offering • Secret management is a headache Deliver code as fast as possible Risk Mitigation, Compliance and avoid data breach
- 6. K8S CUSTOMERS POINTOF VIEW
- 7. K8S CUSTOMERS POINTOF VIEW
- 8.
- 9. CAN WE SECUREUSING ONLY SHIFT LEFT? Others can claim: IMO, NO!!! Micro Services are predictable Pro: Watch for abnormal behavior Con: Not really the case with many types of workloads -> a lot of false positive Immutability Pro: you scan for vulnerabilities and deliver new image every time Con: if the attacker knows how to insert a malware he can do it every time + maybe he is already on the host/other workload
- 10.
- 11.
- 12. WHERE AND WHYEXISTING SOLUTIONS FAIL Endless chase No single source of truth for K8s Configuration Thousands of potential misconfigurations Inability to build a reliable normal baseline False Positives, Complexity, and performance impact Resources intensive Find Vulnerabilities & Misconfigurations Anomaly Behavioral Analysis and Network Segmentation K8S POSTURE MANAGEMENT K8S RUN TIME PROTECTION
- 13. LOOKING TO SECUREKUBERNETES? K8S POSTURE MANAGEMENT K8S RUN TIME PROTECTION kubernetes
- 14. A WHOLE NEW WAY TOSECURE KUBERNETES Infusing Visibility, Control, and Security Seamlessly into Every Workload
- 15. ARMO BRINGS K8SPOSTURE AND RUNTIME TOGETHER - SEAMLESSLY Enrich finding with runtime deep visibility information Shrink the attack surface based on field proven best practices Continuous compliance validation and auditing From Zero to Zero-Trust in 10 minutes No need to change policies when microservices change Resiliency by design, even against the most advanced attacks Add Context and Relevancy to posture findings Patented one-YAML deterministic ZERO-TRUST K8S POSTURE MANAGEMENT K8S RUN TIME PROTECTION ARMO Kubernetes Fabric™
- 16. KEY TAKEAWAYS • Youneed both posture and runtime protection • Scan your posture as soon as possible (shift left) • Apply runtime protection on dev/staging/production Stay Safe! Questions?
- 17. The greatest risk isthe one you are not aware of zvika.ronen@fossaware.com TEL: +972-(0)52-426-5306 All right reserved © FOSSAware LTD
- 18. • I am48 • L.L.B law degree - Ono academic college • I am the CTO of FOSSAware • I specialized in FOSS technologies and software audits • I help organizations to implement a risk management program to manage their OSS usage, lower the remediation costs and comply with ISO standards • I also perform tech due-diligence audits and escort such process for target companies 18 Who am I 18
- 19. 19 Few Words onOpen Source 19
- 20. 20 freely accessed, used,changed, and shared FSF four essential freedoms of the Free Software Definition OSI Ten criteria of the Open Source Software Definition 20 FOSS Definition
- 21. Legal risk • LosingIP protection • Paying Monetary Damages • Block product shipment/distribution (Injunction) • Negative press and damaged relationship with customers Cyber security vulnerabilities • Denial of service, taking a service offline • Business intelligence and Client information theft • Hacker remote access • Ransom attacks Operational risk • Losing ability to build your software due to missing web based components • Losing community support due to open source project with low contribution activities • Using outdated open source components (less secure, more complex to upgrade) Open Source Risks 21
- 22.
- 23. 23 Today Everyone loves OpenSource 23
- 24.
- 25.
- 26. Source: Synopsys OSSRA2021 26
- 27. Source: Synopsys OSSRA2021 Industry Sectors and Open Source 27
- 28. Own Proprietary Software 3rd PartyCommercial Software Open Source Commercial Software Dependencies Open Source Dependencies 28 Open Source in Commercial Software
- 29. 29 Hackers also LoveOpen Source 29
- 30. dateutil vs python3-dateutil350 FORKS jellyfish vs jeIlyfish (“L” is an “I”) 122 FORKS Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks 30 OSS Malicious Package Analysis by the Academy Hundreds of open source packages were used in real cyber events 61% malicious packages used typosquatting 2nd most common – injection to existing package
- 31. Source: Dustico Blog,https://dusti.co/blog/unsafe-to-download-pip/ 31 Downloaded FOSS may include hidden setup
- 32. Source: WhiteSource, 2021 32 OpenSource Vulnerabilities Continue To Increase
- 33. #1 Lodash #2 FasterXMLjackson-databind #3 HtmlUnit #4 Handlebars #5 http-proxy 33 Source: WhiteSource, Top 10 Open Source Vulnerabilities In 2020 33 Top 10 Open Source Vulnerabilities In 2020
- 34. 34 Source: Sonatype, devsecopscommunity survey 2020
- 35. 35 Open Source relatedbreaches occur much too often 35
- 36. Source: Sonatype, devsecopscommunity survey 2020 1 in 5 breaches is Open Source related 36
- 37. Open Source Component- Apache Struts (CVE-2017-5638) 37 Equifax breach was 100% preventable
- 38. • Popularity: 2million downloads per week • Dependency: “flatmap-stream” has malicious code • The action: Harvest the victim’s “copay” private keys • Intention: Steal Bitcoin • Result: 7000 stollen bitcoins 38 The “Event-Stream” incident https://github.com/dominictarr/event-stream/issues/116
- 39. • Open SourceComponent - Mozjpeg (CVE-2020-13790) • Mozjpeg weekly downloads from NPM - 650k Instagram Hack core reason – Mozjpeg 39
- 40.
- 41.
- 42. 42 42 PyPI and NPMFlooded with over 5,000 Dependency Confusion Copycats Source: securityreport.com Copycat behavior (Dependency Confusion based)
- 43. • Human factor(training) • Proprietary code (static analysis) • Supply chain 3rd party (liability & support) • Open Source? • White/Black-box (testing) What is the weakest / unknown link of the chain? 43
- 44. 44 Top 10 WebApplication Security Risks
- 45. “Developers often useavailable open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product.” What Biden has to say on Open Source? 45
- 46. 46 What Should WeDo? 46
- 47. 47 1. Know YourProduct 47
- 48. Homegrown code 3rd PartyCommercial Software Open Source Commercial Software Dependencies Open Source Dependencies 48 Open Source in Commercial Software
- 49. 49 2. Manage yourOpen Source 49
- 50. 3rd Party Commercial Software OpenSource Dependencies Open Source Dependencies 50 Choosing right Manage your software supply chain in “critical software” Manage your Open Source “critical software” — software that performs functions critical to trust (such as affording or requiring elevated system privileges or direct access to networking and computing resources)
- 51. 51 CII Best Practicesbadge program
- 52. End User LicenseAgreement BSD Open Source License 52 Manage risks from 3rd party (Supply Chain) Common Default in Commercial Software Agreements
- 53. Homegrown code OpenSource 3rd Party Proprietary SW Cost All type of software requires some level of compliance and/or vulnerability monitoring Possible Vulnerabilities IP rights Owned Licensed Licensed License Requirements Procurement is being done by Homegrown The developers Procurement people Monitoring is being done using different tools, processes, and policies Who is responsible? The developer The developer The vendor Support By the developer Community/Developer By the vendor Additional Dependencies Access to Source Code Analysis tools Static Code Analysis Software Composition Analysis Penetration Test 53 53 Homegrown vs. Open Source vs. 3rd Party Proprietary SW
- 54. 54 54 1. Risk managementprogram (ISO-5230) • Policy • Process • Tools • Training 2. Early detection = Lower remediation cost 3. Ongoing management (pre-> post production) OSS in Commercial Software Development
- 55. 55 3. Do notinvent the wheel 55
- 56. International Standard foropen source license compliance 56
- 57.
- 58. The greatest risk isthe one you are not aware of zvika.ronen@fossaware.com TEL: +972-(0)52-426-5306
- 59. Automated Red-Team forManaging Attack Surface Alex Peleg CEO | Hacker
- 60. AI and Communitypowered Attack Surface and Operations Management For SMEs Reducing Time From Breach to Fix Recover From Incidents Offensive Engineering Cynergy.app
- 61. Agenda Kesaya breach story AttackSurface 101 Why AI? Continuous Red-Team, the good the bad and the ugly. Open topics for further research and innovation 1 2 3 4 5
- 62. What has gonewrong? A server was exposed....
- 63. Attack Surface 101 Attackersneed only one hole in the defense
- 64. Attack Surface 101 ExternalAttack Surface
- 65. Attack Surface 101 Web& Mobile Apps
- 66.
- 67.
- 68.
- 69. Attack Surface 101 3rd& 4th Parties
- 70.
- 71. Why AI? Context ScaleStupidity
- 72.
- 73. Additional Research... 1 Fasterand Better Context 2 Threat Intelligence to Improve Prioritization 3 AI based mitigation - GPT3 4 Integration with CICD
- 74.
- 75. Thanks and Questions!Alex@cynergy.app Type text
- 76. Turn any Kubernetessolution into Zero-Trust by design FROM ZERO to ZERO-TRUST
- 77. WHAT ARE WEUP AGAINST? What hackers are looking for? What do they do inside? • Data Business & customer’s data • Keys Encryption & Authentication • Resources CPU (coin miners) Storage Network (bots) • Damage & Extortion Ransome DDoS, UI/UX harm • Intellectual Property Algorithms APIs • Use existing software in inappropriate way • Change behavior of existing software Change configuration • Inject new software Corrupt existing software Add new software How do they break in? • Misconfigurations • Credential abuse • Software vulnerability
- 78. KNOCK-KNOCK, WHO ISTHERE? Who is calling my APIs? Who is reading my Data?
- 79. DON’T TRUST, VERIFY! Protectcustomer solutions even if infrastructure is compromised Genuine Software Identity – like DNA Automated Zero-Trust Network Policy Transparent Data Signing & Encryption
- 80. SOFTWARE DNA –WHAT DOES THIS MEAN? Executable DLL/SO DLL/SO ARMOGuard DLL/SO Python/Java/JS/.NET ConfigFile/ConfigMap Environment Variables Command Line ARMO Back-End Prove DNA validity Receive Cryptographic Materials Protect process memory while it runs: • Validate cryptographic digest of every relevant artifact • Prevent unsigned artifacts from loading • Keep containers immutable • Use Kubernetes for automation
- 81. INTENTION POD A Secret Volume PODB Server Legit App Container Container
- 82. REALITY POD A Secret Volume PODB Injected App Server Legit App Container Container
- 83. WITH ARMO ZERO-TRUST PODA Secret Volume POD B Injected App Server Legit App Container Container
- 84.
- 85. • Thank You! •Questions? • To be continued…