Join us for this informative session on "Enhancing OpenShift Security." Andrew Toth from Red Hat will outline typical threats and security measures to protect container deployments and will share information on built-in security features of OpenShift and Kubernetes. Glen Kosaka from NeuVector will present how to enhance security for Kubernetes and OpenShift by using advanced run-time security features to improve visibility and protection in production.

2. Container Security Basics

3. ● Data (secrets exfiltration)
● Access (denial of service)
● Infrastructure (system destruction)
Top attack targets during container application
runtime

4. ● Container breakouts
● Poor Tenant isolation
● Poisoned images
● Host OS exploits
● Kernel exploits
Classic attack vectors targeting containers

5. ● Namespaces
● Linux capabilities
● SELinux
● Seccomp
● Cgroups
● R/O Mounts
● Use minimal Host OS
● Update system patches
● Use trusted images
● Use image security scanner
● Quarantine poisoned images
Top ways to increase container security

6. ● Use as many security layers as possible
● Restrict access to your platforms and
images
● Minimize attack surface
● Apply Host OS and Kernel security patches
● Only run trusted up to date container images
● Run containers with the least privileges
possible
● Use a container image security scanner
Container security best practices

7. Security Enhanced Container Platform Ecosystem
RED HAT CONTAINER
CATALOG

8. Layered Security Approach
OpenSCAP Image Vulnerability Scanning
Role Based Access. Registry/image Whitelisting/Blacklisting,
Security Contexts (Linux Capabilities, SELinux, mount points,
SecComp). Tenant isolation (Network namespaces, application
isolation), Resource Constraints (CGroups)
3rd Party Integrations
Reduced attack surface, Immutable filesystem, Namespaces,
SELinux, SecComp, CGroups, Linux Capabilities
Role Based Access
Image Providence
System Patching
Image Providence
Image Security Monitoring and Grading
RED HAT CONTAINER
CATALOG

10. Security
Automation For
OpenShift &
Kubernetes

11. Hyper Scale
East-West Traffic
Explosion
Low Visibility
Open Source
Vulnerabilities
Sophisticated
Insider Attacks
Container Runtime
east - west
Security
Automation ?
With Kubernetes Automation Comes New Challenges and Risks
K8S WORKER NODES
pod

12. ZERO-DAY
ATTAC K S
Zero-Day
DDoS
DirtyCow
SQL injection
DNS Tunneling
WannaCry
Privilege escalation
Break out detection
Container Runtime
east - west
WORKER NODES
pod
Traditional Security: Blind To Container Attacks
INSIDER ATTACK S

13. Unauthorized Connections: Detect at Layer 3 - 7
Exploit Over Trusted IP/Ports: Detect at Layer 7
Known Application Attacks: Detect at Layer 7
Privilege Escalation: Detect in Pod / Host Process
Data Exfiltration: Reverse Shell / Tunneling
Unauthorized Egress/Ingress: Detect at Layer 3-7
for Non-Containerized Workloads
1
OpenShift / Kubernetes Run-time Vulnerabilities - Examples
2
3
4
5
6
WORKER NODES
pod pod
east - west1
2
4
6
3 5

14. • Automatic Deployment & Updates
• Continuous Auditing & Compliance
• Run-Time Protections
• Automated Threat Detection (DDoS, DNS, SQLi …)
• Network Based Application Isolation (Layer 7)
• Endpoint Process & Syscall Monitoring
• Security Response
NeuVector OpenShift & Kubernetes Security Automation

15. OPENSHIFT/
KUBERNETES
NEUVECTOR
Registry Scanning
RBAC, Secrets Management
Pod Resource & Security Management
Network Policy – L3/L4 Isolation
Layer 7 Deep Packet Inspection, Isolation
Threat Detection
Automated Packet Capture
Connection Visualization, Monitoring
Suspicious Process Detection
CIS Benchmarks & Run-Time Scanning
Enterprise Grade Management
Network Security
Endpoint Security
Compliance
Integration
Build,
Infrastructure
& Deployment
Critical OpenShift & Kubernetes Security Enhancements

16. EXTERNAL &
LEGACY APPS
Container Runtime
OPENSHIF T WORKER NODE
pod
Container Runtime
OPENSHIF T WORKER OR MASTER NODE
pod
east - west
E
NeuVector + OpenShift Architecture
E
C
M
➢ RBAC
➢ Project
➢ Namespace
➢ Service
➢ Deploy-
ments

17. Demo
OpenShift Console
NeuVector Console
Violation Detection

18. Thank you.
FIND NEUVECTOR ON THE
RED HAT CONTAINER CATALOG
https://access.redhat.com/containers
registry.connect.redhat.com/neuvector/allinone
For more information, contact us at
info@neuvector.com
neuvector.com