Watch the webinar at: https://codefresh.io/events/devsecops-deploy-secure-cloud-native-apps-fast/ Modern enterprises are constantly evolving their development practices by automating manual processes to deliver applications to market more quickly. This new “DevOps” model of application development enables organizations to more effectively serve their customers by bringing products to market faster. When it comes to security, however, this method comes with an added layer of complexity. In order to securely manage the velocity and scale of agile software delivery, DevOps teams must adopt a “security-first” mentality. This is done by shifting security considerations to the left and building security into their development pipeline. In this webinar, we’ll show you how you can: Build software quickly, using custom job orchestration See all of your builds, including failed builds and slow tests Identify vulnerabilities and malware in your images as you build your application

1. © 2019 Aqua Security Software Ltd., All Rights Reserved
@texanraj
DevOps - Deploy Secure Cloud
Native Apps FAST
Aqua Security
Raj Seshadri – Solutions Architect
raj@aquasec.com
@texanraj

2. 2 @texanraj
Cloud native technology brings a dramatic shift
in speed, scale and networking
Dev cycles
Scale
Connectivity
Infrequent,
major releases
10x per host,
weeks/months
Few apps,
few nodes
Continuous
deployment
1000x per
host,
hours/days
Dozens of
interconnected
micro services
Attack
surface
CONTAINER
VM

3. 3 @texanraj
The Threat Landscape

4. 4 @texanraj
Where Security Fits

5. 5
Security as a
shared
responsibility
Protect workloads
with focus on
prevention
Secure Once,
Run Anywhere
 “Shift left” security, fix
issues early and fast
 Whitelist good behavior,
preventing anomalies
 Secure the application
uniformly across clouds
and platforms
Aqua Security: Our Approach
Make Cloud-Native the most secure, predictable and controlled
platform for running critical applications

6. 6 @texanraj
The Container Lifecycle
Changes move in one direction
Track image and
ensure integrity
Block unapproved
images
Enforce image risk
policy
Scan for vulnerabilities,
malware, OSS, secrets
Base-image policy
Check configuration
Cryptographic
digest of image
What is the risk of running an image? What can a running container do?
Hard-
Coded
Secrets
Malware
Known
CVEsOSS
Licenses
Unapproved
Base
Images
Build Ship Run

7. 7 @texanraj
Shift Left: Baked-In vs Bolt-On Security
Build RunShip
 
• Unique digest
• Continuous scan for CVEs
• CVE blacklist & whitelist
• Risk Score
• Feedback to developers
1 2 3
Aqua Cyber
Intelligence

8. 8 @texanraj
Secure Once, Run Anywhere

9. 9 @texanraj
Integration into Codefresh CI

10. 10 @texanraj
Aqua Image Scanning
Key Features
 CVE scanning based on multiple sources (NVD,
vendor advisories, proprietary research) - updated
continuously
 Scans for hard-coded secretes in images (tokens,
private keys, certificates)
 Scans for malware
 Checks best practice configuration issues
 Supports all Docker registries
 Native plug-ins for CI/CD including Codefresh,
Jenkins, VSTS, Bamboo and others
Languages

11. 11 @texanraj
Aqua Runtime: Focus on Prevention
 Immutable applications are easier to
protect:
 Updates should only be done via a monitored
build process
 Any change made to a running application is
therefore suspicious
 Aqua checks application contents against
its originating build artifact
 If a change is detected – generates alert,
can block the specific change attempt
Original
Application
Observed
Behavior
Protected
Application
















 
 

12. 12 @texanraj
 Runs checks against all 200+
CIS tests
 Provides a scored report of
the results
 Can be scheduled to run daily
Aqua is a CIS SecureSuite member
Kubernetes & Docker CIS Benchmarks

13. 13 @texanraj
Kubernetes Open Source Security Tools
Open-source project automates CIS Benchmark testing
• Get it at https://github.com/aquasecurity/kube-bench
Open-source project for pen-testing Kubernetes deployments
• Get it at https://kube-hunter.aquasec.com/

14. 14 @texanraj
Containers Present an Opportunity
for Better Security
 Prevent unknown images
 Stop image by CVEs and score
 Stop user privilege escalation
 Stop suspicious processes
 Control capabilities
 Enforce network isolation
 Protect the host resources
 Encrypt sensitive variables
 Enforce use of automation tools
 Visibility across the environment

15. 15 @texanraj
Secure your workloads
 Prepare a plan
 Involve your teams
 Use the tools at hand
Try Aqua and Secure Your Cloud Native Workloads Today
Try Aqua on a Cloud Marketplace

16. Thank You
@texanraj