Download as PDF, PPTX
![Environment Hardening
9
◎ Continuous monitoring of your Kubernetes clusters
○ Wherever they're hosted [AWS - EKS, Azure - AKS, GCP - GKE, On-Premise (using
ARC)]
○ Continuously assess clusters to provide visibility of misconfigurations
○ Provide Guidelines to mitigate the issues
◎ Kubernetes data plane hardening
○ Azure Policy add on
◉ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and
safeguards on clusters in a centralized, consistent manner.
○ Defender Daemonset
◉ Deployed to each worker node, collects security-related data and sends it to
Defender for analysis. Required for runtime protections and security
capabilities](https://image.slidesharecdn.com/container-security-using-msft-defender-230320050142-e998ab46/85/Container-Security-Using-Microsoft-Defender-9-320.jpg)
![How it works
14
◎ Defender for Containers receives and analyzes:
○ Audit logs and security events from the API server
○ Cluster configuration information from the control plane
○ Workload configuration from Azure Policy
○ Security signals and events from the node level
◎ Components deployed
○ Azure Policy add on
◉ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and
safeguards on clusters in a centralized, consistent manner. [azure-policy,
azure-policy-webhook]
○ Defender Profile Daemonset
◉ Deployed to each node provides the runtime protections and collects signals
from nodes using eBPF technology. [Microsoft-defender-collector-ds,
microsoft-defender-publisher-ds, microsoft-defender-collector-misc]](https://image.slidesharecdn.com/container-security-using-msft-defender-230320050142-e998ab46/85/Container-Security-Using-Microsoft-Defender-14-320.jpg)
Uploaded byRahul Khengare
Container Security Using Microsoft Defender
Microsoft Defender for Containers provides security for container workloads running on Kubernetes. It monitors clusters for misconfigurations and vulnerabilities, provides runtime threat detection, and generates alerts. It works across multiple clouds by deploying agents and daemons to collect security signals from the API server, nodes, and images. A demonstration showed Microsoft Defender in action monitoring container workloads.
More Related Content
Similar to Container Security Using Microsoft Defender
Container Security Using Microsoft Defender
- 1. Container Security withMicrosoft Defender Rahul Khengare 18th Mar 2023 DevOps-Pune Meetup Group
- 2. About Me Sr. StaffEngineer, Zscaler ◎ Cloud Security/DevOps/DevSecOps/SRE ◎ Blogger (oss-world, thesecuremonk) ◎ Co-Organizer ○ DevOps-Pune, DevSecOps-Pune ◎ Open Source Software and CIS Contributor ◎ Past Organization: Cloudneeti, Motifworks, NTT Data ◎ https://www.linkedin.com/in/rahulkhengare
- 3. Agenda ◎ Need forContainer Security ◎ Overview of Microsoft Defender for Cloud ◎ Microsoft Defender Capabilities ◎ How it works ◎ Demo
- 4. How you aresecuring the container workloads?
- 5. Known Practices ◎ Useof private registry and trusted images ◎ Continuous Vulnerability scanning of images (Trivy, Encore) ◎ Limit container privileges ◎ Use of network segmentation ◎ Implement least privilege access (RBAC) ◎ Logging and Monitoring ◎ Implement runtime security for threat detection ◎ Preventive and detective policies - Kyverno ◎ Security and Compliance Audits ◎ Certificates, securing endpoints ◎ Many More …
- 6. “ 93% experienced atleast one security incident in their Kubernetes environments in the last 12 months - State of Kubernetes security report * Kubernetes adoption, security, and market trends report 2022
- 7. Microsoft Defender What itis? Capabilities? How it works?
- 8. Overview of MicrosoftDefender for container ◎ Cloud Native solution to ○ Improve ○ Monitor ○ Maintain the security of your clusters, containers, and their applications. ◎ Multi-cloud Supports K8s offering and registries from different CSP like EKS, GKE, ECR ◎ Kubernetes Native Deployment at Scale ◎ Provides Security Alerts and Remediation Capabilities RUN TIME Threat Detection ENVIRONMENT HARDENING Cluster Configurations Vulnerability Container Image Container Security
- 9. Environment Hardening 9 ◎ Continuousmonitoring of your Kubernetes clusters ○ Wherever they're hosted [AWS - EKS, Azure - AKS, GCP - GKE, On-Premise (using ARC)] ○ Continuously assess clusters to provide visibility of misconfigurations ○ Provide Guidelines to mitigate the issues ◎ Kubernetes data plane hardening ○ Azure Policy add on ◉ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and safeguards on clusters in a centralized, consistent manner. ○ Defender Daemonset ◉ Deployed to each worker node, collects security-related data and sends it to Defender for analysis. Required for runtime protections and security capabilities
- 10.
- 11. Vulnerability Assessment 11 ◎ SupportsAzure ACR and AWS ECR ◎ Triggers ○ On push ○ Recently pulled ○ On import ○ Continuous scan based on an image pull and for running images ◎ View and remediate findings ◎ Disable specific findings like severity below medium, non patchable findings
- 12. Runtime Threat Protection 12 ◎Provides real-time threat protection ◎ Generates alerts for suspicious activities ◎ Threat protection at the cluster level ○ Provided by the Defender agent and analysis of the Kubernetes audit logs. ◎ Threat protection at Host level ◎ Monitors the attack surface of multi cloud Kubernetes deployments based on MITRE ATT&CK® matrix for Containers ◎ Examples: ○ Exposed Kubernetes dashboards, High-privileged roles, Sensitive mounts ○ Anomalous secret access, Detected suspicious file download, Possible backdoor detected
- 13. Runtime Protection -Alerts 13
- 14. How it works 14 ◎Defender for Containers receives and analyzes: ○ Audit logs and security events from the API server ○ Cluster configuration information from the control plane ○ Workload configuration from Azure Policy ○ Security signals and events from the node level ◎ Components deployed ○ Azure Policy add on ◉ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and safeguards on clusters in a centralized, consistent manner. [azure-policy, azure-policy-webhook] ○ Defender Profile Daemonset ◉ Deployed to each node provides the runtime protections and collects signals from nodes using eBPF technology. [Microsoft-defender-collector-ds, microsoft-defender-publisher-ds, microsoft-defender-collector-misc]
- 15. How it worksfor AKS 15
- 16. How it worksfor EKS 16
- 17. How it worksfor GKE 17
- 18.
- 19.
- 20. References ◎ Microsoft Defenderfor container ◎ Runtime alerts for Kubernetes cluster ◎ Azure provided container recommendations ◎ Vulnerable K8s for testing ◎ Azure Policies for K8s