Kubernetes Security with Calico Software – Utpal Bhatt, Tigera

This is Textron TV. Hey guys. Thanks for the throw.

We're here with whoop. Tell bat who is Chief marketing officer for taijira? And we're talking about runtime Security in the age of kubernetes.

And what's going on in that whole Space? What about welcome to the show. Thank you very much, Mike.

Thanks for the opportunity. What makes securing kubernetes different we've been securing runtimes forever and a day but there seems to be a lot of nuances and a lot of focus on platforms that are designed specifically for kubernetes. And so what drives that conversation Yeah, an excellent question.

Yeah, you know kubernetes is fundamentally different in in a few different ways right one is compared to your traditional infrastructure. The kubernetes infrastructure is fairly ephemeral. And sometimes you have yeah pods that are you know, they exist only for five minutes and then it disappear and some sometimes they they are.

There for a longer duration. Also, you're giving kubernetes a collection of these machines or nodes that they can kubernetes can decide depending on whichever notice free and wherever there is the right amount of capacity to you know, sponsor part there and that could be in a in a fairly distributed environment. So you really not don't know where you're going to find your pod to be running and so And that makes it number one.

It's ephemeral. It's very distributed. And it's it's continuously changing.

Now. The other thing would have what happens within kubernetes and especially what makes it very hard to do any kind of A permanent of the door apply any perimeter-based security is that you know inside the kubernetes cluster. The IP addresses are not fixed.

And so, you know these pods they'll have ever changing IP addresses. So, you know traditionally when you had tools like your firewalls that relied on a fixed Network address. to protect, you know or allow or deny traffic and those types of those types of Technologies just won't work in a kubernetes environment.

So the scalable I mean the distributed the ephemeral the fact that you have an ever-changing set of ips inside the cluster all these make kubernetes very different type of environment than what traditional tools were built to protect and hence, you know, you really need tools that are there are more kubernetes native that they understand the inner working of this environment and they're hard of that fabric so that they can detect both the threats that are coming in from the network as well as from your containers and protect the environment against those threats. And you guys have been driving a level of convergence around project Calico and it seems like security and networking are coming together in a way that maybe was not possible another platforms before this. So what is your sense of what is the relationship between security and networking as we go forward?

And is that change in these Cloud native environments? Yeah, so, you know one of the one of the things that we have through our experience and work in helping, you know, really Leading Edge organization. So embraced the kubernetes environment, you know, we have enough come to the conclusion that securing kubernetes requires a holistic approach and what that holistic approach means that you know, you have to take into consideration.

A few different things in order to secure environment number one because kubernetes has the very large attack surface and what I mean by that is that you know each kubernetes. each containerized application is made up of these small little services or workloads that are communicating with each other their communicating with the internet their Community communicating with the data center or external services that Big you have to first of all reduce the attack surface and that's very can bring the principles of like zero trust networking in a kubernetes environment that you know, now the same principles that you that a traditional networking environment would use to limit. The number of ways your application can access other resources outside your trusted zone or other.

an external parties can access your application the same principles need to be applied at a very granular level to kubernetes where each part or each workload needs to have the right level of access controls configured where you need to have the right level of segmentation in our micro segmentation built in just out of the gate, right? So that's kind of taking those principles of your trust and applying that to kubernetes the net result of that is that When the application has been deployed there are just fewer ways that your attackers can get into your environment because you've locked all those access points. So that's number one.

And that is something that the foundation of project Calico provides our platform. Right? The project Calico was all about, you know.

It's a kubernetes native container networking and security environment and it enforces policies at the part level the namespace level and these policies are granular and then they can determine who can and who cannot access your given workload or service. So that's number one and that's given to us by the foundational project Calico. What we've done on top of that is that we said, all right.

So now we have reduced the attack surface of your application, but No, we have to assume that attackers will find a way around that to still get inside your application. So the question is if they do, how are they going to do it and can be You know detect those types of attacks and stop them and so we kind of as we look at it. We see four different types of vectors one is that you can have your attackers come into you from the network, so Your clusters communicating outside, you know, it could be communicating with a malicious server or that could be traffic from the outside coming in.

So that's number one network-based attacks number two. Is that as you are building your application your image may have Vulnerability or your image may have been compromised and when you're when you're creating a container a container may have a malware already loaded on it. And so you can have a tax that originate from the container.

So you have to protect or detect both types of attacks. That's number one number two, is that you have a tax that are known. There, you know you already know the signature of the attacks because alien world or Miss databases.

They've already kind of captured the history of these attacks and identify their signatures. And so you have to you can leverage that or their attacks that are kind of zero day attacks which are entirely new and you don't know about them. So we provide detection capabilities for all those scenarios.

So number one when it comes to network-based attacks, you know, we have A workload Centric firewall, for example the workload Centric firewall what it does is it automatically detects any type of ovas 10 attacks, you know cross-site scripting SQL injection things like that and it blocks them number two. What we do is we have an intrusion detection and prevention system. What do what we where we do we integrate with the threat intelligence feeds like alien Walt or if you're using your own custom threat intelligence provider like a crowdstrike you can bring that in and what we do is we look at you know, what are the IP addresses that are malicious and we block traffic from to and from any of those IP addresses.

So that's number two. number three, what we do is We keep a database of process file hashes. And these hashes file hashes are essentially malware signatures.

So we you know, we take that data from a Mis database and as if a container tries to create a new in around a new executable with that and creates that file hash we can automatically detect it and stop the execution of that and alert your security teams. So that's kind of everything that is what we say are known and signature-based detection techniques. Now on top of that what we see that there are a lot of attacks that have not yet been discovered and what about them?

So we have fairly Advanced capabilities that what that rely on ebpf-based programs and probes. That will monitor both the container activity. So we look at syscalls.

We will look at in a file access and we will what we'll do is we'll monitor this container activity and look for signs of compromise, right our signatures of attacks. Sorry, and for example, if a part is trying to access the file that it's not supposed to or you know, it makes this call that it's not supposed to you know, that's automatically flagged as hey there's something going on that that needs to be looked at. And so we we have these ebpf probes that monitor all those activity and on top of that we write these are the Box detectors.

So we have detectors that cover pretty much all types of techniques or tactics described in the minor framework both for containers and for Network. and these detectors will take that data that we have collected apply the detection Lodge Jake and then if there's a match then we'll say right you know, it looks like you may have an attack underway in this area of your application and as soon as we Get that we will alert your security team. So that's kind of the second part so that you know just recap the first was reducing the attack surface with principles of zero trust.

Second part was very sophisticated detection. That's you know, it's comprehensive because it looks at Network. It looks at container.

It looks at both signature-based attacks and behavioral attacks and the best part about our detection is that it's Plug and Play so I'm like You know like a lot of Open Source detection engines or other other platforms where you have to write these rules, you have to kind of write these complex rules that account for any each and every type of possibility from a detection standpoint all the detectors that we provide come out of the box and they are just always enabled that means that your security team doesn't have to spend a lot of time configuring and testing to make sure that their environments protected. So that's number two. The third thing that we provide and again that's the benefit of Calico open source is the ability to mitigate the risk of exposure.

So imagine, you know, despite reducing the attack surface and and you know, you still get attacked and now you have your detection logic as identified at an attack is underway, and there's certain pod. That has been attacked is trying to exfiltrate data by communicating with an external server. What we can do is we can automatically recommend policies that will limit the communication from that particular part or namespace with that external server and we can block that we can quarantine that particular pod and we can use forensics to identify, you know, where where who it was communicating with what kind of data and then we can use that to further Harden our our security configuration.

So with the three things and reducing the attack surface a very comprehensive plug-and-play detection and then Rich, you know contextual mitigation tactics. So that just gives you a comprehensive platform. We think that it's something that most devops security teams will greatly benefit from you know, we continuously see that these teams are always Strapped for time and resources and they need something.

That's that's much easier to work with and much more comprehensive. Is in your sense that security in the realm of kubernetes is still an afterthought because you know kubernetes very complex platform and it's kind of hard to secure and it kind of feels like as you look at it. The platform was built in the security controls weren't necessarily fully baked when it first came out and now it's in production environments and people are coming to terms with all this stuff.

yeah, you know I would say it's it's definitely getting the attention of security teams across the board for two reasons. Number one that you know, it's becoming much more mainstream. There are it's not longer the you know, the early adopters and Visionaries and we're seeing, you know, early majority jumping in and deploying large kubernetes clusters if you see the growth of Even manage kubernetes environments or or platforms like curved at openshift.

You can see that you know, organizations of all sizes are adopting kubernetes and earlier. It was just to lift and shift you took your existing application put it in the cloud. Now, a lot of those are gonna applications are getting re-architected using a microservices based architecture which then You know introduces all the challenges we talked about earlier in the segment, you know larger tax surface and ephemeral environment highly distributed environment.

And so security teams are now almost mandating that the kubernetes environments have the same kind of security posture and compliance that they would expect from the traditional applications. We see more and more security teams, you know, demonstrate fairly Nuance understanding of the kubernetes environments and we're super excited about that and security teams are forcing the agenda and asking their devops and platform teams to make sure that the kubernetes environments are secure. It also seems to me that we are obsessed with shifting everything left these days and devsecopsis and top of mind, but do we forget about the runtime in all of that?

Because the assumption is that somehow or other we all just make the applications more secure that their runtime will just magically work. And so I wonder if we're kind of lost sight of some of the more important attributes of the security Paradise. Yeah, and you know, I think that's I'm glad you say that see I think.

That with new sticky the most important attribute. I feel like the what's been lost is this is appreciation for defense and depth and I think with the shift left the even the pendulum started doing so fluff the lot of a lot of people thought that there was the Silver Bullet and as long as we You know eliminated. Any type of vulnerability early on in a development cycle called everything earlier than everything downstairs would be secure.

and so that's why I kind of we just focused all our efforts on that shift left with code scanning and image scanning and so on and really forgot about configuration and runtime security and what we have seen through numerous attacks, you know, whether it was you know, I just gave the TNT the log4j we've seen so many instances where that have Pro and that shift left alone is not enough to capture everything, you know, you will have vulnerabilities like log 4G that get detected once your application is in production. And so, you know we at tigera, you know, we definitely our holistic approach is really based on this defense and depth strategy that there is no it's like the analogy is like securing. You know, you know securing your house right?

Are you gonna put four locks on the front door? Are you gonna put a lock on every door inside the house as well? And so make sure if somebody breaks into the front door.

They have the next door and next door and next door, which is a essentially a defense in depth strategy. So we certainly you know advocate for shift left and say should have your your scanning capabilities, but then you should also have the right level of workloader access controls that you obey the principles of zero trust so that you are your environment is secure if somebody tries to break in especially the known malicious actors your stopping that for them from getting in and then runtime security is very important because you have to assume that either you having attacked and you don't know about it. Or no, they're only two scenarios like either you've been attacked and you know about it or you've been attacked and you don't know about it, right?

There's no such thing as when I get attacked right you it's you are gonna get attacked and so in that situation your runtime security has to be on point to capture that and then more importantly The mitigation is is very is has to be there, right you're security and your devops team need those mitigation controls because to fix something once you detect something from one, you know, sometimes the detection alone can take a long time. And then after you detect something like once the vulnerability log for Jay vulnerability was detected. Some organizations took upwards of two months to fix it.

And in the meantime, your application is open, right? So mitigation controls are extremely important because they lock it lock down your application right away. And make sure that that breach doesn't turn into a disaster.

Right because you now quarantine the infected applicate in a part of your application. You've given your Deva developers a little bit more Runway to fix it. But in the meantime, you're not exposed so in summary, yeah shift left alone is not the right strategy.

There is no substitute as any good security Personnel will say there's no substitute for defense and depth which means shift left you have to do also the configuration security and your runtime security All right, folks. You heard it here. You got to shift everywhere.

I left right and back in for it. I think about thanks for being on the show. Thank you very much, Mike.

Alright. Thanks to you guys in the studio.