How to Secure Your Kubernetes Software Supply Chain at Scale
0 likes104 views
The document discusses strategies for securing Kubernetes software supply chains, focusing on lifecycle management, operational efficiency, and compliance risks associated with complex software delivery. It introduces Anchore as a solution for enhancing security through deep image inspection, policy enforcement, and API-centric integration within the Kubernetes ecosystem. Key features of Anchore include continuous monitoring, vulnerability tracking, and customizable policies to protect against various security vulnerabilities.
How to Secure Your Kubernetes Software Supply Chain at Scale
- 1. Securing K8s Supply Chain How to Secure Your Kubernetes Software Supply Chain at Scale
- 2. Housekeeping 01 02 03 All participant lines are muted Questions will be accepted throughout, enter questions via Q&A panel You will receive a follow-up email with a link to the recording 04 Please respond to poll questions as they are appear on your screen
- 3. Cornelia Davis Tech fellow & VP of Product Spectro Cloud Alan Pope Director of Developer Relations Anchore
- 4. © 2024 Spectro Cloud®. All rights reserved. 4
- 5. © 2024 Spectro Cloud®. All rights reserved. 5 How do we establish and manage that Kubernetes environment?
- 6. Palette: a unique platform for K8s at scale Model what the clusters will look like OS K8s CNI CSI Add-ons / integrations Applications Unified profile-based management across all layers
- 7. Palette: a unique platform for K8s at scale Model what the clusters will look like Manage the full lifecycle create, maintain, update, delete OS K8s CNI CSI Add-ons / integrations Applications Unified profile-based management across all layers Full-stack Compatibility Checks Cost control Auto-healing Drift prevention Simplified DevX Palette Virtual Clusters Multi-cluster observability
- 8. 8 Palette: a unique platform for K8s at scale Model what the clusters will look like Manage the full lifecycle create, maintain, update, delete OS K8s CNI CSI Add-ons / integrations Applications Unified profile-based management across all layers Full-stack Compatibility Checks Wherever you need them Cost control Auto-healing Drift prevention Simplified DevX Palette Virtual Clusters Multi-cluster observability
- 9. 9 Palette: a unique platform for K8s at scale Model what the clusters will look like Manage the full lifecycle create, maintain, update, delete OS K8s CNI CSI Add-ons / integrations Applications Unified profile-based management across all layers Full-stack Compatibility Checks Wherever you need them Decentralized policy enforcement Distributed architecture promotes resilience, scale, and more. Cost control Auto-healing Drift prevention Simplified DevX Palette Virtual Clusters Multi-cluster observability
- 10. © 2023 Spectro Cloud®. All rights reserved. 10 Kubernetes-as-a-Service Request Request Governance Access Visibility Cost control Request Deploy Deploy Deploy Benefits • Operational efficiency – no tech debt • IT Ops empowering dev teams without being blockers • Fast delivery of clusters and full-stack lifecycle management • Multi-cluster governance • Compatibility with existing toolchain
- 11. © 2023 Spectro Cloud®. All rights reserved. 11
- 12. © 2023 Spectro Cloud®. All rights reserved. 12
- 13. © 2023 Spectro Cloud®. All rights reserved. 13
- 15. Software Supply Chains today are complex Run Deploy Stage Build Source Many dependencies brought in at each stage Multiple teams and tools Multiple Source repos Multiple builds per day Multiple registries Multiple deployments Multiple clusters Scan Limited checks
- 16. Your DevOps Toolchains Your DevOps Process Run Deploy Container Platform Automated Config Registry CI/CD SCM Stage Build Develop Source Public & Private Repos Security Risks Can Enter Anywhere Known vulnerabilities Insider attacks Zero day vulnerabilities Typo squatting Insider attacks Patch site attack Stolen credentials Compromised tool Plugins with malware Dependency hijacking Typo squatting Stolen credentials Workload Platform
- 17. How Anchore Enterprise can help Pass/Fail for best practices or compliance controls via policy-as-code Visibility Inspection Policy Enforcement Remediation Reporting DevOps SecOps & Compliance SBOM metadata and (optional) data stored in database for querying Security issues assessed continually against stored SBOMs Notifications sent via native developer tools about security issues Scheduled or ad-hoc reports for triage, SLA, compliance, or trending ✅ ❌ SBOM generated locally in CI or pulled for backend generation CI/CD Registry Runtime Vuln Feed
- 18. SBOMs
- 19. What Makes Anchore Unique Deep image inspection and SBOM generation Find issues with OS packages, libraries, licenses, binaries, credentials, secrets, and metadata. This rich data is stored as an SBOM with higher fidelity than other SBOM standards. Based on 100% open source Syft and Grype Reduce false positives Flexible policies for compliance Scan source code repos Anchore provides fewer false positives due to accurate SBOMs, precision vulnerability matching algorithm, hints, corrections, and allowlists. Anchore enables compliance and control with out-of-the-box policy packs and flexible, customizable policies using any SBOM or vulnerability metadata. Anchore enables you to scan source code repos to shift further left. This also enables you to scan non-containerized workloads.
- 20. What Makes Anchore Unique API-centric for developers/DevOps Anchore provides 100% API-coverage with fully-documented APIs so developers don’t have to leave their tools. Discover malware/secrets and misconfigurations Anchore goes beyond vulnerabilities to identify secrets, malware, and misconfigurations in your containers, code, or dockerfiles. Runtime protection Anchore provides policy gates before deployment and offers continuous monitoring of running images for security and compliance risk. Visibility into all vulnerabilities Anchore identifies and tracks all vulnerabilities, not just those that violate policies, for a complete picture of your security posture.
- 21. Anchore Enterprise: How it Works Anchore Enterprise Run Deploy Stage Build Source Runtime SCM CI/CD Registry Docker v2 API Admission controller AnchoreCTL AnchoreCTL Enterprise Capabilities ● Linux and Windows containers ● Malware & secrets scanning in addition to vulnerabilities ● Fully-supported integrations with CI/CD tools ● Continuous scanning from develop to runtime ● Persist SBOMs and security results across apps and teams ● Enhanced vulnerability feed ● Centralized policy enforcement with pre-built policy packs ● API/GUI for reporting and auditing ● Notifications ● Remediation recommendations & workflows ● Enterprise control with support for RBAC, SSO, LDAP ● SLA Technical Support K8S Inventory EKS Inventory Policy Enforcement | Compliance Vulnerabilities SBOM Management Analyzers Analyzers Analyzers Analyzers Analyzers Reporting | Auditing Malware | Secrets False Positive Mgmt Remediation
- 22. Policy Bundle Components Policies Named set of rules and actions Allowlists Named sets of rule exclusions to override a policy Mappings Ordered rules to determine which policies & allowlists to apply to which images Allowlist Images Overrides for images to set the final result to pass Blocklist Images Overrides for images to set the final result to fail
- 24. © 2024 Spectro Cloud®. All rights reserved. 24 So then how do you bring Anchore into your Kubernetes ecosystem?
- 25. 25 Palette: a unique platform for K8s at scale Model what the clusters will look like Manage the full lifecycle create, maintain, update, delete OS K8s CNI CSI Add-ons / integrations Applications Unified profile-based management across all layers Full-stack Compatibility Checks Wherever you need them Decentralized policy enforcement Distributed architecture promotes resilience, scale, and more. Cost control Auto-healing Drift prevention Simplified DevX Palette Virtual Clusters Multi-cluster observability
- 26. © 2024 Spectro Cloud®. All rights reserved. Modeling Addons - Cluster Profiles
- 27. © 2024 Spectro Cloud®. All rights reserved. Creating Cluster Profiles
- 28. Questions
- 29. Wrapping up
- 30. Get started with a free trial of Anchore Enterprise https://get.anchore.com/free-trial/ Learn more about Spectro Cloud https://www.spectrocloud.com/security https://www.spectrocloud.com/product/sena Visit our GitHub and Community Slack github.com/anchore and https://anchore.com/slack Learn more about Anchore customers https://anchore.com/case-studies/ Next Steps