This document discusses how cloud computing, hybrid architectures, and agile IT delivery are transforming infrastructure and application delivery. It notes that traditional, static IT approaches are being replaced by more dynamic, automated approaches enabled by cloud, software-defined data centers, and DevOps practices. This brings challenges for security, which must also become more dynamic, automated, and integrated with development workflows. The document introduces CloudPassage Halo as a security platform designed for these new approaches, with capabilities like vulnerability monitoring, integrity monitoring, and policy-based controls that can scale across cloud and data center infrastructure.

1. The New Best Practices:
Cloud Computing, Hybrid Architecture and Agile IT Delivery
Sami Laine
Principal Technologist
CloudPassage

2. Introducing CloudPassage
On-demand, automated security platform that works anywhere, at any scale
Mature startup – $91M funding from leading VCs
100+ enterprise customers
7X growth in protected workloads in last 2 years

3. 3 | © 2016 CloudPassage Confidential
How long do your
most transient
workloads live?

4. 4 | © 2016 CloudPassage Confidential
Weeks MinutesHours

5. Transformation of Infrastructure Delivery
Driven by business
Agility, Speed, Efficiency
Software-defined DC IT-as-a-Service Public, Hybrid & Multicloud

6. Transformation of Infrastructure Delivery
Traditional (Mode 1) Modern (Mode 2)
Data Center
Data Center, SDDC
or Private Cloud
Public, Hybrid
or Multi-Cloud
• Data center & perimeter oriented
• Applications on dedicated hardware
• Total ownership, visibility & control
• Low rate of change
• Cloud oriented, degraded perimeter
• Shared resources, distributed workloads
• Shared ownership, low visibility & control
• High rate of change

7. 7 | © 2016 CloudPassage Confidential
How many
more servers
will you have?

8. Performance Data Source: Geekbench (Primate Labs)
AWS EC2 c4.large
Score: 3,911
36 nodes
Azure Standard A3
Score: 3,594
39 nodes
Dell PowerEdge R930
Score: 141,129
1 node
Infrastructure Scale

9. Performance Data Source: Geekbench (Primate Labs)
AWS EC2 c4.large
Score: 3,911
36 nodes
Azure Standard A3
Score: 3,594
39 nodes
Dell PowerEdge R930
Score: 141,129
1 node
30-40x more
systems to secure
Infrastructure Scale

10. 10 | © 2016 CloudPassage Confidential
How often
will your
servers change?

11. Transformation of Application Delivery
Jan DecFeb Mar Apr May Jun Jul Aug Sep Oct Nov
Q1 Q2 Q3 Q4
Mon Tue Wed Thu Fri Sat Sun
November
Plan Code DeployTest/QA
Waterfall (Mode 1) DevOps (Mode 2)
• 9-12 month cycle time
• Very large release size
• Manual deployment
• 1-day cycle time
• Frequent, small changes
• Automated deployment

12. Transformation of Application Delivery
Source: Puppet Labs 2016 State of DevOps Report
Speed
200x
200x more
frequent
deployments
Resilience
24x
24x faster
recovery from
failures
Quality
3x
3x lower
change failure
rate
Efficiency
2,555x
2,555x shorter
lead times
Security
2x less time
on security
remediation
2x

13. Source: Puppet Labs 2016 State of DevOps Report
Speed Resilience Quality Efficiency
200x 24x 3x 2,555x
200x more
frequent
deployments
24x faster
recovery from
failures
3x lower
change failure
rate
2,555x shorter
lead times
Security
2x less time
on security
remediation
2x
Transformation of Application Delivery
200x more
frequent deployments

14. 14 | © 2016 CloudPassage Confidential
So what?

15. Speed and Automation Breaks Traditional Security
Sorry about that.
Data Center, SDDC
or Private Cloud
Public, Hybrid
or Multi-Cloud

16. Speed and Automation Breaks Traditional Security
• Perimeter and network focused
• Heavy footprints on systems
• Built for static IP addresses
• Not designed for automation
• Lacks comprehensive APIs
• Relies on dedicated appliances

17. 17 | © 2016 CloudPassage Confidential
Agile IT
requires
agile security!

18. Release Process
Plan Code Build Test Release Deploy Operate
Agile Development
Continuous Integration
Continuous Delivery
DevOps
Value
Continuous Deployment
OpsDev
Collaboration

19. Traditional Security
Plan Code Build Test Release Deploy Operate
Achtung!
Security
Gate!

20. Yay! Security Guardrails!
Re-align Security To Modern IT Delivery
Plan Code Build Test Release Deploy Operate

21. Yay! Security Guardrails!
Re-align Security To Modern IT Delivery
Plan Code Build Test Release Deploy Operate
• Plan – Define security policy and benchmarks for each type of workload
• Build & Test – Catch vulnerability & configuration issues, generate baselines
• Deploy – Apply production policies to systems automatically
• Operate – Continuously feed SecOps and Audit & Compliance systems

22. Re-align Security To Modern IT Delivery
• On-demand, self-service
• Automated, rapid expansion
• Measured or metered service
• Ubiquitous, convenient access
• Resource pooled grid
• Highly scalable
• Design-pattern based
• On-demand, Security-as-a-Service
• Automated, rapid expansion
• Metered licensing
• Ubiquitous, convenient access
• Resource pooled grid
• Highly scalable
• Design-pattern based
Agile IT Delivery Agile Security Delivery

23. 23 | © 2016 CloudPassage Confidential
What is the
new role
of security?

24. New Role of Security
vs.
Culture
• collaboration
• education
Automation
• integration to toolchain
• policy development
Measurement
• outcomes
• feedback

25. The Eight Imperatives for Agile & Scalable
Cloud Security
1. Deeply automated & API-driven
2. Ready for orchestration
3. Built into workloads
4. Runs anywhere
5. Context-aware & policy-based
6. Broad set of controls
7. Instant & long-term scalability
8. Aligned with DevOps principles

26. 26 | © 2016 CloudPassage Confidential
OK, so…
what do you guys
do about it?

27. CloudPassage Halo
Reduce Software
Attack Surface
• Vulnerabilities
• Configuration
• Accounts
Monitor for
Compromise
• Integrity
• Intrusion
Reduce Network
Attack Surface
• Connections
• Firewall
• Authentication

28. VMs
Servers
VMs
Public Clouds Data Centers & Private Clouds
VMs
Infrastructure Orchestration
SOC & GRC Systems