This document discusses software supply chain security and container deployment best practices. It recommends using continuous integration/continuous delivery pipelines to automate building, testing, and deploying container images. The document also advocates for scanning container images for vulnerabilities, digitally signing images, and controlling access to images and runtimes using policies. Canary and blue/green deployments are introduced as strategies to reduce risk when deploying changes.

1. THE CLOUD
CONNECTIVITY COMPANY
CLOUD CONNECTIVITY
1

2. THE CLOUD
CONNECTIVITY COMPANY 2

3. THE CLOUD
CONNECTIVITY COMPANY 3

4. THE CLOUD
CONNECTIVITY COMPANY
■ The Software Supply Chain
■ Finding Vulnerabilities
■ Additional Concerns
4

5. THE CLOUD
CONNECTIVITY COMPANY 5

6. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. See change in production
6

7. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. See change in development
environment
3. See change in production
7

8. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. Unit testing
3. See change in development
environment
4. Integration testing
5. See change in production
8

9. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. Push to git
3. Jenkins/CI builds the app
4. Unit testing
5. See change in development
environment
6. Integration testing
7. See change in production
9

10. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. Push to git
3. Jenkins/CI builds the app
4. Push to container registry
5. Unit testing
6. See change in development
environment
7. Integration testing
8. See change in production
10

11. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. Push to git
3. Jenkins/CI builds the app
4. Push to container registry
5. Unit testing
6. See change in development
environment
7. Integration testing
8. Deployed to production
11

12. THE CLOUD
CONNECTIVITY COMPANY
■ Start with small portion of
audience
■ Check results
■ Roll out to the rest of the
audience
Canary deployment
■ Create new environment
■ Shift traffic to new
environment
■ Test
■ Shift back or repurpose old
environment
Blue/Green deployment
12

13. THE CLOUD
CONNECTIVITY COMPANY 13

14. THE CLOUD
CONNECTIVITY COMPANY
1. Make change
2. Push to git
3. Jenkins/CI builds the app
4. Push to container registry
5. Unit testing
6. See change in development
environment
7. Integration testing
8. Deployed to production
14

15. THE CLOUD
CONNECTIVITY COMPANY
■ The whole image every time
■ Catches vulnerabilities even if
library names change
Full image scanning
■ Just changes since the last
scan
Layer analysis and differentiation
15

16. THE CLOUD
CONNECTIVITY COMPANY
■ Black Duck/Synopsys
■ JFrog/Xray
■ FOSSA
■ Literally hundreds more
Commercial tools
■ Anchore Engine
■ CoreOS/Clair
■ Vuls.io
■ OpenScap
Open source tools
16

17. THE CLOUD
CONNECTIVITY COMPANY
■ Get the Common
Vulnerabilities and Exposures
(CVE) number
■ Note the layer the CVE is in
■ Possible to override specific
CVEs
17

18. THE CLOUD
CONNECTIVITY COMPANY
■ Using base images
■ Using private registries
18

19. THE CLOUD
CONNECTIVITY COMPANY 19

20. THE CLOUD
CONNECTIVITY COMPANY
■ Public key cryptography
■ Works by tag
20

21. THE CLOUD
CONNECTIVITY COMPANY
docker tag myimage
nickchase/imageswecansign:1
docker trust key generate mykey
docker trust signer add --key
mykey.pub mysignerkeys
nickchase/imageswecansign
docker trust sign
nickchase/imageswecansign:1
Signing an image
DOCKER_CONTENT_TRUST=1 docker pull
nickchase/imageswecansign:1
{
"content-trust": {
"mode": "enforced"
}
}
Using a signed image
21

22. THE CLOUD
CONNECTIVITY COMPANY
■ Each step adds a new
signature
■ All signatures must be
present
22

23. THE CLOUD
CONNECTIVITY COMPANY
■ Runs as server
■ Data
■ Query
■ Policy
■ Returns true/false
23

24. THE CLOUD
CONNECTIVITY COMPANY
{
"joe": [
"read"
],
"anika": [
"read",
"write"
]
}
Data
24

25. THE CLOUD
CONNECTIVITY COMPANY
{
"input": {
"user": "anika",
"operation": "write"
}
}
Query input
25

26. THE CLOUD
CONNECTIVITY COMPANY
package myapi.policy
import data.myapi.acl
import input
default allow = false
allow {
access = acl[input.user]
access[_] == input.access
}
Policy
whocan[user] {
access = acl[user]
access[_] == input.access
}
26

27. THE CLOUD
CONNECTIVITY COMPANY
$ curl -X POST http://localhost:8181/v1/data/myapi/policy/allow
--data-binary '{ "input": { "user": "joe", "access": "write" } }' | jq
{
"result": false
}
27

28. THE CLOUD
CONNECTIVITY COMPANY 28

29. THE CLOUD
CONNECTIVITY COMPANY
■ Prevent changes to tags
○ Tags send the code down
the pipeline
29

30. THE CLOUD
CONNECTIVITY COMPANY
■ Dev/staging
■ Production
30

31. THE CLOUD
CONNECTIVITY COMPANY
■ Make sure it supports cloud
■ Static definitions don't work
well with dynamic pod
scheduling
■ Accessible when necessary
for audit
31

32. THE CLOUD
CONNECTIVITY COMPANY
■ Both global and per application
■ Alert if tampered with
■ Audit log of changes
■ Flow logs and evidence reports for audit
32

33. THE CLOUD
CONNECTIVITY COMPANY
33
Image RegistrySecurity scan
& sign
Traditional
Third Party
Microservices
docker store
DEVELOPERS IT OPERATIONS
Control Plane

34. THE CLOUD
CONNECTIVITY COMPANY
■ Integrate security scanners for containers
■ Centralize user identity and access control capabilities
■ Isolate containers running microservices from each other and the
network
■ Encrypt data between apps and services
34

35. THE CLOUD
CONNECTIVITY COMPANY 35