VA_InterConnect2017

InterConnect
2017
Securing Your Docker
Environment with
Vulnerability Advisor in IBM
Bluemix Container Service
Chris Rosen
Senior Technical Offering Manager
crosen@us.ibm.com
Canturk Isci
Research Manager,
canturk@us.ibm.com
1 5/16/2018

2 5/16/2018
Please note
IBM’s statements regarding its plans, directions, and intent
are subject to change or withdrawal without notice at IBM’s
sole discretion.
Information regarding potential future products is intended to
outline our general product direction and it should not be relied
on in making a purchasing decision.
The information mentioned regarding potential future products
is not a commitment, promise, or legal obligation to deliver
any material, code or functionality. Information about potential
future products may not be incorporated into any contract.
The development, release, and timing of any future features
or functionality described for our products remains at our sole
discretion.
Performance is based on measurements and projections
using standard IBM benchmarks in a controlled environment.
The actual throughput or performance that any user will
experience will vary depending upon many factors, including
considerations such as the amount of multiprogramming in
the user’s job stream, the I/O configuration, the storage
configuration, and the workload processed. Therefore, no
assurance can be given that an individual user will achieve
results similar to those stated here.

AGENDA
• Getting started with Docker
• Scared straight – security concerns everywhere
• IBM Bluemix Container Service
• DevSecOps
• Vulnerability Advisor details

New Section
Docker pull wordpress
Docker run wordpress
IBM Bluemix Container Service | IBM Confidential | ©2017 IBM Corporation

“Over 30% of Official
Images in DockerHub
Contain High Priority
Security Vulnerabilities”
Banyan Ops report
Source: http://bit.ly/2eknhJs
“80% of attacks leverage known
vulnerabilities and configuration
management setting weaknesses”
US State Department report
Source: http://bit.ly/2esbkke
The Heartbleed bug allows anyone on the Internet to
read the memory of the systems protected by the
vulnerable versions of the OpenSSL software. This
compromises the secret keys used to identify the service
providers and to encrypt the traffic, the names and
passwords of the users and the actual content. This
allows attackers to eavesdrop on communications, steal
data directly from the services and users and to
impersonate services and users.
Source: http://heartbleed.com
The consequences of an attacker
successfully exploiting this vulnerability
on a Web server are serious in nature.
For example attackers may have the
ability to dump password files or
download malware on to infected
computers. Once inside the victim’s
firewall, the attackers could then
compromise and infect other
computers on the network.
Source: http://symc.ly/2e1blNM

New Section

IBM Bluemix Container Service

• Fully managed hosted
runtime
• Integrated logging and
monitoring
• Container groups
• Private hosted registry
• Persistent storage
• Advanced security
features
• Built using Docker
technologyIBM Bluemix Container Service | IBM Confidential | ©2017 IBM Corporation

Beta available March 20th.
Combining Docker and Kubernetes to deliver powerful tools,
an intuitive user experience, and built-in security and
isolation to enable rapid delivery of applications - all while
leveraging IBM Cloud Services including cognitive
capabilities from Watson.
www.ibm.com/cloud-computing/bluemix/containers

Intelligent Scheduling Automated rollouts and rollbacks Container Security & PrivacyDesign Your Own Cluster
Self-healing Horizontal scaling Leverages IBM Cloud & Watson Integrated Operational Tools
Service discovery & load balancing Secret & configuration management Simplified Cluster Management Native Kubernetes Experience

Slide Title Goes HerePersonas
Value for both the provider and consumer
(Ex: User pushes their custom images into IBM Bluemix Container Registry)
I want to meet my organization’s security & compliance
criteria without having to jump through a complex process
We want to make sure images don’t introduce malware
and misbehaved applications into the IBM Cloud.
Analyze and report in near real-time where vulnerabilities
exist.
I want to enforce my organization’s security & compliance
policies across our enterprise applications on Bluemix
I want to audit my organizations overall compliance
posture
Developers/
Testers
IBM Cloud
Security
&
Operations

Slide Title Goes HereDevSecOps
D e ve l o p m e n t + S e c u r i t y + O p e r a t i o n s
 The purpose and intent of DevSecOps is to build on the mindset that "everyone is
responsible for security" with the goal of safely distributing security decisions at
speed and scale to those who hold the highest level of context without sacrificing the
safety required.
Source: http://www.devsecops.org/blog/2015/2/15/what-is-devsecops
 The goal of DevSecOps is to enable teams to release intrinsically secure software at
the speed of DevOps.
 Security as code
 Integration with existing CI/CD pipelines
 Ability to scan and run tests in every stage of deployment

What is
Vulnerability
Advisor?
• VA is a service within IBM Bluemix Container Service combining
platform visibility and threat intelligence for early detection of
vulnerabilities.
• VA is providing security and compliance insight to your Docker
images and containers that run in the IBM Cloud.
• VA reduces the effort, but does not change the responsibility model.
• VA is designed to scan new and existing images, identifying new
vulnerabilities as they are identified.
• VA is intended to be used against all of your test, development,
and production environments.
• VA uses introspection technology, therefore no agents or image
modifications are required.

VA
Concepts
Policy Violations
Configuring policy to determine if a vulnerable image can be
deployed by users
Vulnerable Packages
Analyzing a Docker image and container packages for security
vulnerabilities
Best Practice Improvements
• A set of security checks
• Provide recommendations to remediate
Security Misconfigurations
• A security misconfiguration issue in your application
• Provide insight for remediating these misconfigurations

Slide Title Goes HereI B M B l u e m i x C o n t a i n e r S e r vi c e H i s t o r y
IBM Bluemix
Container
Service go-live
in Dallas
June 2015 July 2015 Sept 2015 Nov 2015 Oct 2016
Vulnerability
Advisor (VA)
launches for
image
vulnerability
scanning
IBM Bluemix
Container
Service go-live
in London
VA scanning
images for
weak
configurations
and ability to
set deployment
policies
VA scanning
live containers
Secure Config
Advisor for
applications
VA scanning
for POWER
Docker images
Nov 2016
File-based
malware
detection
Risk Analysis
for discovered
vulnerabilities
Jan 2017
Integration with
IBM X-Force

Simplifying the user experience

TITLE
subtitleBluemix Design System | IBM Confidential | ©2016 IBM Corporation 18
Day Zero Docker Image Scanning
Vulnerability AdvisorIBM Bluemix Container Service | IBM Confidential | ©2017 IBM Corporation

Slide Title Goes HereSelect an image from your registry

Slide Title Goes HerePolicy Violations

Slide Title Goes HereVulnerable Packages

Slide Title Goes HereCVE (Common Vulnerabilities & Exposures)
 Publicly known security issues
 Vulnerabilities
 Exposures
 Risk management

Slide Title Goes HereBest Practice Improvements
Description: Minimum password length not specified in
/etc/pam.d/common-password
Corrective Action: Minimum password length must be 8.

TITLE
Secure Config Advisor

Slide Title Goes HereApache: Vulnerable
Use of insecure ciphers
Summary of insecure configurations in detected
application (Apache web server)
Use of insecure cipher suite in
Apache web server configuration found

Slide Title Goes HereApache: Remediated
Developer fixed the cipher suite in Apache w eb server configuration
and pushed a new Docker image. The scan verified the fix.
V11: Version with insecure cipher suite was v10
The developer remediated the cipher suite in Apache web server
configuration and created a new Docker image. The scan has verified the
fix resolved the vulnerability.

TITLE
Day 1+ Container Scanning

Slide Title Goes HereDeployed Containers

Slide Title Goes HereContainers Report

TITLE
Policy Management

Slide Title Goes HereImage Deployment Policies

TITLE
Risk Analysis

Slide Title Goes HereHow bad is it really?

Slide Title Goes HereRisk Analysis Details
This pane shows a base score of a
CVE having the maximum value in the
image.
This pane shows a temporal score of
the CVE having the maximum base
score showing on the left side.
CVE-2015-0860

TITLE
Malware Detection

Slide Title Goes HereMalware Detection Details
Additional Best Practice Rule for malware detection

TITLE
Secure your Pipeline

Slide Title Goes HereVA Security Built into Your Dev[Sec]Ops Pipeline

TITLE
Conclusion
Containers are the next generation of cloud computing.
According to Enterprise Technology Research, 97% of enterprises interviewed plan to
implement Docker container technology.
Containers enable innovation and speed and without the proper security insight can
lead to catastrophic problems for your business.
IBM Bluemix Container Service makes security a first class component of the offering
and simplifies security insights.

Slide Title Goes HereThere is a Blog for That…
• Day1+: https://www.ibm.com/blogs/bluemix/2016/11/vulnerability-advisor-secure-your-dev-ops-across-containers/
• PowerVA: https://www.ibm.com/blogs/bluemix/2016/11/secure-your-docker-containers-on-power-with-vulnerability-advisor/
• SecConfig: https://www.ibm.com/blogs/bluemix/2016/11/identifying-insecure-configurations-with-ibm-vulnerability-advisor/
• Malware: https://www.ibm.com/blogs/bluemix/2017/01/vulnerability-advisor-file-based-malware/
• Drift: https://www.ibm.com/blogs/bluemix/2017/01/vulnerability-advisor-app-security/
• Risk Analysis: https://www.ibm.com/blogs/bluemix/2017/02/assessing-security-risk-containers-vulnerability-advisor/

41 5/16/2018
Notices and disclaimers
Copyright © 2017 by International Business Machines Corporation (IBM).
No part of this document may be reproduced or transmitted in any form
without written permission from IBM.
U.S. Government Users Restricted Rights — use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM.
Information in these presentations (including information relating to
products that have not yet been announced by IBM) has been reviewed
for accuracy as of the date of initial publication and could include
unintentional technical or typographical errors. IBM shall have no
responsibility to update this information. This document is distributed
“as is” without any warranty, either express or implied. In no event
shall IBM be liable for any damage arising from the use of this
information, including but not limited to, loss of data, business
interruption, loss of profit or loss of opportunity. IBM products and
services are warranted according to the terms and conditions of the
agreements under which they are provided.
IBM products are manufactured from new parts or new and used parts.
In some cases, a product may not be new and may have been previously
installed. Regardless, our warranty terms apply.”
Any statements regarding IBM's future direction, intent or product
plans are subject to change or withdrawal without notice.
Performance data contained herein was generally obtained in a
controlled, isolated environments. Customer examples are presented
as illustrations of how those customers have used IBM products and
the results they may have achieved. Actual performance, cost, savings or
other results in other operating environments may vary.
References in this document to IBM products, programs, or services
does not imply that IBM intends to make such products, programs or
services available in all countries in which IBM operates or does
business.
Workshops, sessions and associated materials may have been prepared
by independent session speakers, and do not necessarily reflect the
views of IBM. All materials and discussions are provided for informational
purposes only, and are neither intended to, nor shall constitute legal or
other guidance or advice to any individual participant or their specific
situation.
It is the customer’s responsibility to insure its own compliance with legal
requirements and to obtain advice of competent legal counsel as to
the identification and interpretation of any relevant laws and regulatory
requirements that may affect the customer’s business and any actions
the customer may need to take to comply with such laws. IBM does not
provide legal advice or represent or warrant that its services or products
will ensure that the customer is in compliance with any law.

42 5/16/2018
Notices and disclaimers
continued
Information concerning non-IBM products was obtained from the
suppliers of those products, their published announcements or other
publicly available sources. IBM has not tested those products in
connection with this publication and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM
products. Questions on the capabilities of non-IBM products should be
addressed to the suppliers of those products. IBM does not warrant the
quality of any third-party products, or the ability of any such third-party
products to interoperate with IBM’s products. IBM expressly disclaims
all warranties, expressed or implied, including but not limited to, the
implied warranties of merchantability and fitness for a particular,
purpose.
The provision of the information contained herein is not intended to, and
does not, grant any right or license under any IBM patents, copyrights,
trademarks or other intellectual property right.
IBM, the IBM logo, ibm.com, Aspera®, Bluemix, Blueworks Live, CICS,
Clearcase, Cognos®, DOORS®, Emptoris®, Enterprise Document
Management System™, FASP®, FileNet®, Global Business Services®,
Global Technology Services®, IBM ExperienceOne™, IBM SmartCloud®,
IBM Social Business®, Information on Demand, ILOG, Maximo®,
MQIntegrator®, MQSeries®, Netcool®, OMEGAMON, OpenPower,
PureAnalytics™, PureApplication®, pureCluster™, PureCoverage®,
PureData®, PureExperience®, PureFlex®, pureQuery®, pureScale®,
PureSystems®, QRadar®, Rational®, Rhapsody®, Smarter Commerce®,
SoDA, SPSS, Sterling Commerce®, StoredIQ, Tealeaf®, Tivoli® Trusteer®,
Unica®, urban{code}®, Watson, WebSphere®, Worklight®, X-Force® and
System z® Z/OS, are trademarks of International Business Machines
Corporation, registered in many jurisdictions worldwide. Other product
and service names might be trademarks of IBM or other companies. A
current list of IBM trademarks is available on the Web at "Copyright and
trademark information" at: www.ibm.com/legal/copytrade.shtml.

InterConnect
2017
Thank you
Learn more:
https://www.ibm.com/cloud-
computing/bluemix/containers
43 5/16/2018

VA_InterConnect2017

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to VA_InterConnect2017

Similar to VA_InterConnect2017 (20)

More from Canturk Isci

More from Canturk Isci (7)

Recently uploaded

Recently uploaded (20)

VA_InterConnect2017

Editor's Notes