Downloaded 17 times
Uploaded bySomik Behera
Container Infrastructure Security for Cloud Native Infrastructure
The document discusses the implementation of zero trust security in container infrastructure, emphasizing its importance for secure access and identity management. It outlines various layers of container infrastructure and the need for pluggable local identity systems to support zero trust principles. Key considerations include network segmentation, compute hardening, and mutual authentication to enhance security across and within these layers.
Container Infrastructure Security for Cloud Native Infrastructure
- 1. Pluggable Identity ForContainer Infra Security Somik Behera @strikesme
- 2. 2 somik@CS-Summit:~$ whoami Somik BeheraProduct Mgmt Lead Mesosphere Inc. Since 2015 somik@CS-Summit:~$ last somik | less somik Product Lead Mesosphere Inc. May 2015 still logged in somik Founding Prod. Lead VMware Cloud Native BU Aug 2012 May 2015 somik Product Line Leader VMware NW & Sec. BU Aug 2012 May 2015 somik Product Mgmt Lead Nicira Inc. Feb 2011 Aug 2012 somik Core Dev & Founder Openstack Neutron Feb 2011 Aug 2013 somik MTS - Tech. Lead VMware Inc. May 2005 Feb 2011 INTRODUCTION
- 3. 3 OVERVIEW - WHATTHIS TALK IS ABOUT Local SPIFFE 20% 80%80% 20% Container Mgmt Infrastructure Identity Mgmt Infrastructure
- 4. ZERO TRUST SECURITY AQuick Primer 4
- 5.
- 6.
- 7. ZERO TRUST BASICS 7 ●Secure Access ● Access Model of Least Privilege ● Trust but Verify Verify AND Never Trust
- 8. ZERO TRUST FORCONTAINER INFRA What does Zero Trust mean for Container Infra? 8
- 9. LAYERS OF CONTAINERINFRA. 9 Network Compute Container Orchestration Distributed Services
- 10. ZERO TRUST BETWEENTHE LAYERS 10 Network Compute Container Orchestration Distributed Services
- 11. ZERO TRUST WITHINEACH LAYER 11 Network Compute Container Orchestration Distributed Services
- 12. IDENTITY CRITICAL TOZERO TRUST 12
- 13. IDENTITY & ZER0TRUST 13 Network Compute Container Orchestration Distributed Services Loc al
- 14. IDENTITY NEEDS TOBE PLUGGABLE 14 Local SPIFFE
- 15.
- 16. CONSIDERATIONS FOR SECURITYACROSS LAYERS 16 Network Compute Container Orchestration Distributed Services 1. Network Segmentation across Zones 2. Compute Hardening 3. Container aware Privilege Access Mgmt. 4. Mutual Authentication with Encryption for Container Orchestrator to Compute Node communication 5. Mutually Authenticated, Authorized & Encrypted Service Launcher to Container Orchestrator communication
- 17. CONSIDERATIONS FOR SECURITYWITHIN LAYERS 17 Network Compute Container Orchestration Distributed Services 1. Network Isolation between Services 2. Static and Runtime Vulnerability Management 3. Service Accounts for Authentication & Authorization 4. PKI for Internode communication a. For Services. b. For Container Orchestration elements.
- 18. IMPLEMENT ZERO TRUSTTODAY - WWW.DCOS.IO 18 MANY TOOLS. ONE APPROACH - ZERO TRUST.
- 19.
Editor's Notes
- #8 List Vulnerabilities