good how are you going i hope good good now comes a very talk
very interesting by engineer alfredo pardo is called defense in depth
for container-based applications alfredo is from córdoba he is cloud
security architect from cops and is also python from belo but he is passionate about
cybersecurity automation and emerging technologies the bus that
evangelize in best practices the environments based on accountants and environments
cloud so his talk is basically based on making the
software development cycle is more secure in those infrastructures
container-based so we're going to hear that it's only very
interesting and well thank you very much if you look for a second
I'm going to share my screen with you
let's check that everything looks good a vision from that side
excellent good first I want to thank you
share to the cordoba hacker space and to the ute n which is where I received from
engineer for giving me this opportunity to bring you this talk today.
talk about defense in depth for container-based applications and
I am interested in taking some important issues for those who want
get started as ds cops let's see some concepts and best practices
that if they deepen them they will have a very interesting profile for the market
current second I want to share
some tools that I was researching to save you that too
path that can be used by those who can test them and finally who can think
on how to apply this to corporate environments today power when they go to
an interview they will ask them how to solve problems then while
the more they can apply this to what a business is the easier it is going to be
and get a job successfully pass some interviews a little more
information about my work as cloud security are cyst that in 3 x in my
I am also a professor of computer security and auditing in the fourth year of
systems engineering degree at the catholic university of cordoba and
I'm also a student I'm still studying the master's degree in cyber defense
at the university of national defense for now we are studying it in a
Remote Buenos Aires and Cordoba too
and good to align a little what the knowledge that the audience has
I want to tell you for those who do not know that it is a container, basically it is a
way to package applications and their dependencies so that they can
move between environments without suffering too much disturbance at the time of
execution what is sought is everything that makes an application unique
inside the container so that everything on the outside can
be standardized as are the ports that allow network connections between
the different containers what is to share volumes or systems of
file etc. it is also important to incorporate this
concept of ciro trust this framework invites organizations to distrust
at all times of everything that happens both inside and outside the perimeter of
organizations and before granting any type of access encourages
both the origin or who is requesting that
access
Well containers must be analyzed in context both applications
that run internally like everything that is around that is why I propose this
layered model where internally we have the application with everything
that implies and externally we have the host which is where it is running
effectively the container we have a cluster that manages each of those
containers and in turn that cluster is supported by an infrastructure that
it can be cloud or it can be a prize for the case of companies that have the
servers within their own building to each of these layers I have
identified with a number so that they can follow them throughout the
presentation I will mention some some actions
and controls that can be done on the applications and then I will
describe in a little more detail we have different stages of modeling
threats or fred modeling the analysis of software or software compositions
composition analysis static or static safety tests
application security testing and dynamic or dynamic security tests
application security testing these are just some actions or controls that are
that run on applications there are many more of course but the idea is
give them something introductory so they can continue to deepen what
Threat modeling is specifically identifying, understanding and communicating both
threats as mitigation is something of value we want to protect this so
In general, it is preferably intended that it be carried out in the initial stages of
development in the stage where the architecture of the
application and one of the challenges that they will find when they want to
this is that generally the teams of architects of architecture or of
development do not have sufficient documentation on the architecture of the
application with which it will first be difficult to identify the components and
then grab each component and be able to identify the threats surrounding
that component specifically then we have the composition analysis
software that basically consists of analyzing the dependencies that make up
both a third-party and open source app and see if those
Dependencies have known vulnerabilities or are outdated by
example to update the an example of this can be the
sheet-based backend applications have for example a file and it is called
pacas points jason who names the dependencies and the versions of each one
of these and in turn these dependencies have others building a tree of
dependency and this can be very complex because while the package
principal may not have vulnerabilities if their
dependencies
then we have the sas or static code analysis tools that
they basically seek in the code to identify exploitable functions to
find security breaches generally these tools today tend to
go to the video to the development environment some examples of this
it may be what I have seen are visual studio that has some extensions
that not only suggest recommendations about the code but also about the
packages and versions packages that is, they go a little further and are also
they get into what is software composition analysis
then the dynamic security tests or tools of those are
basically the web application analyzers that are usually used
from outside the application to see what vulnerabilities we find
from outside houas has a project called web benchmark that seeks
promptly analyze scientifically the results of the different
tools and compare the accuracy of these
some documentation that can be used to support each of these
stages we have, for example, for what is static analysis the practices of
safe code proposed by Aguas for what is dynamic analysis we have the
waters 'top ten' of web applications and the road network is an interesting piece of information
proposed by gartner is that by 2022 it is expected, but it is expected that 80 percent
percent of security breaches occur in eyed peas networks with the
What if they specialize in this if they specialize in this area are they going to have a
promising future and then we have the security verification standard of
applications that will help us to deepen to go beyond this' top
have 'that includes the most common but it will not
background in this standard will allow you to delve a little more into that topic
we have some vulnerability analysis tools the most common today
in the market they are or whatsapp that a differential characteristic that it has is
which has a docker image that you can easily integrate into environments
Continuous integration and can be extended is a free tool
bert suite also has its community edition that can help us make a
more in-depth analysis maybe a little more manual in this edition but
it also has corporate versions that can be integrated into pipelines and then
if we want to avoid exposing credentials or secrets within the code of our
of our application we can rely on tools such as hash bold and corp
the center for internet security is a site of their sites and security dot org
that offers solutions products services and tools and has something
very interesting that they are documents for different components of the
architecture such as cloud providers web servers base servers
data virtualization software etc. is undoubtedly the main place
to visit when we want to start finding best practices to apply in
each of the components of our environment and it is something that I use
usually in my classes also to bring the best to the best
practices well habitually when we begin to
develop an application the number of containers is small this so
can usually be run on one team and is fairly easy to
administrate do care is a software that allows the
creation, deployment, and execution of container-based applications a
fundamental feature of docker is that it makes use of the system kernel
operational which makes your images light and have very good
performance
and I think it is important to understand the architecture of each of the
components that we are going to see to know where the attacks can come from
docker has its engine which is called docker engine which has three components
the main one is the server or doctor damon who is in charge of managing
the images the containers the network and the volumes of information then has
a pillai network used to interact with
this dimon and expose outward interfaces either for commands or for
scripts specifically and then you have the client or the dockers and the eye that is the
oker command that through the network is responsible for managing this dimon
from a higher level point of view the docker client can be
communicate if it is on the same host directly with the network shape and if there is
the if the host or doctor damon is on another machine uses unique sockets to
communicate and have some components like images that are templates
definition templates that will have a container where they define what
packages will have which user will be the one with whom it was going to run and so on
then the container becomes an instance of the image basically se
takes the image and the container is the execution of what is defined in that
image and on the other hand the other important component is the registry that
is where these images are stored to be downloaded and then
transformed into containers at the time of execution we have records both
public as private a public one is docker hub which is the link listed in
the bottom
and when we think about common docker attacks we can think about what they are
common attacks to an operating system for what are the containers in the
that an attacker seeks to gain access or execute remote code in the container
this can be finding faults in the application for example buffer overflow
Sícoli injection and once the attacker manages to enter this container
if the settings are bad, you will have the possibility to jump to others
containers or even access doctor damon to persist this attack
remembering that containers generally have a short useful life for
generally, in the best of cases, they know how to spend more time running and with
Regarding the registry, one can think of individual man-type attacks where
we try to download an image and we receive a different image than the one
we try to unload with which here it is important to incorporate the concept of
docker content after you go involves verifying the integrity of the
image through signatures or signatures and of course verify who is the one who
he posted that image fine when we go to the see site
security that we mentioned a while ago we find many versions of
benchmark for different versions of docker we are occasionally interested in delving
a little bit about the community edition, which is the free version that
is the one that is being used the most and among its best practices we have
all these host configuration refers specifically to partitions to
how the service is configured doctor damon configuration sets
some restrictions at the network level speak specifically about what they are name
space is that are allows to group groups of contestable
of container groups running a given application so that
other application pools cannot access these containers and vice versa
then doctor damon configuration files that allow us to set
some limitations at the network level weak images and files have
best practices for eg downloading images from repositories
correct do not use the root account when running images make sure that
the image has the minimum number of packages it needs to run the
application etc. container ranking refers to
secure linux configurations limit memory and cpu resources among others
things and security operations does little punctually in limiting the
number of containers we can run on a host in order to again
home your resources and touch your soul is an orchestration option of
containers in this case we are not going to see it because we are going to see an alternative
fortunately all these controls that in this document are tried
to [ __ ] manually are automated with some tools
docker itself provides this tool called docker bench for security
where we can see basically if it seems to him that the cabins are safe that
you are in the proper fine there they are updated well
in a few minutes two minutes or less but it was also understood the same ok perfect
well then here we have each of the controls that were listed in
this document are executed in an automated way
and this luckily allows us to go to a jason format that we can later later
analyze with other tools
and then we proceed to what is the static analysis of images already
we get through everything that is the docker setup stage itself now
let's see how are the images we are using within docker
in this case I did a small study taking a post on the docker blog
where were the most popular images of 2019 and the most searched build a
list of these images and I was running three tools
mainly dedicated to this purpose on the one hand we have the Quran Ying
we have to read and we have tribe as you can see in the graphs trevi could
get results where the other two failed to do so in some cases
with claire the results were quite similar in other types of images
and they made quite a difference with ancor engine this can be seen a little more
in detail in the other graphs analyze if I remember correctly about 15 images
and that led me to say well tribi is much easier to install than run
and it gets better result with which if I have to do static analysis of
images I stay with this tool additionally as in the other cases
allows us to export to jason to later be able to analyze with some tool
as was the case that I did for this research and something interesting that
It happened to my surprise I did an article with this analysis and it ended up being
shared by the official aqua security account which made me very happy like this
how interesting out there to do these analyzes and not stay the ones and not
to be able to share them well we have a good time we leave what is the
container layer and we move on to what is the host layer in the same place
you say security if for example we want to use ubuntu to run our host
our virtual machine in the cloud we have the possibility to first choose
between different different versions of ubuntu and then we have options for those
different cloud providers for the main ones for separate w south and for
google cloud this facilitates the launch of machines
virtual machines with this configuration already ready and by default and of course it has
an additional cost to what it would be to create our own virtual machine with
our own ubuntu distribution for all the maintenance you are
images leads we also have best practices for
different versions of ubuntu that if it is considered that they are still supported or that
some features of these best are still running
practices are the initial configuration where the file system is defined
updates using sudo to avoid indiscriminate use
from the account rut, some startup configurations and others at the service level are
look for critical services such as time synchronization
are running and those common services that are not required to be
disable at the network configuration level we look for the host files to
dina children side and who are responsible for allowing and rejecting access are
configured that the firewall is configured and that those services or
those network protocols unknown sites enable at the login level and
audit that login is enabled and protected that retention
data is appropriate at the level of access authentication and
authorization we verify for example the ssh configurations of users and
groups and task scheduling with chrome and maintenance level
systems we verify both files that have execution privileges
excessive such as critical file settings in management
of users as they are for w and shadows we have a tool that although not
is specific or does not refer specifically to the 6 benchmark it serves us
to audit and is very aligned with what is the benchmark called lines
of this tool gives us very good results on the screen
unfortunately as output it produces a file that which at the time of
analyzing it is quite complex and not very useful but luckily there is someone who
developed a tool that converts that file to either jason format
or html to be analyzed well so far we have talked about a
small number of containers that were running maybe on a single host
and that they were easily manageable what happens when we scale this to a level
business when the containers become hundreds or thousands it becomes very
difficult the orchestration becomes very difficult for the administration then
we must go to an orchestration tool the tool of
orchestration par excellence today is gubern & es that allows you to automate
implementation of scaling and management of these applications
based on containers that vernet uses logical units that are
they call posts where they group one or more containers and this allows you for a
side standardize the way of deployment and make it simple
As we did with do care, it is convenient that we see a little of the
cv vernet architecture is to understand where the
attacks we have two major components to say in some way on the one hand
we have control plane that what is on the left and on the other side
we nobles have that what is in the bottom right, the 'notes are the ones that
worker none are those that actually execute the workload have two
main components the proxy club that is mainly used for
establish network connections with the master and the led club which is the one that makes
monitoring for the node itself and for the spots or for the containers that
they are running in the pods if they have any problem you can destroy them
and re-initialize them on the other hand in the control plane
we have the club server which is the one that communicates with the workouts
and what does the handling of posts do together with the one that looks for the blend and the cid and
which is a key-value base that basically has the entire state of the
cluster then attacks usually
rulers are given due to misconfiguration issues, for example if the
city ​​has no authentication and has write permissions can allow you
the attacker modify the complete state of our cluster and be able to access what
that you want on the other hand if we will access a container inside a pot and the token
that is exposed within that contain has no controls has no roles
assigned correctly in the ipad server can allow us to jump to others
posts or control the piai server itself and have absolute control of the
cluster also on site 10 and security as well
we found benchmark for different versions of cv verne test and
additionally we can find for google it is important to clarify what to play
mind was initially developed by google and google is the one that contributes the most to
its development and has many facilities in google cloud for what it is to lift
a cluster and another interesting thing to mention is that the controls that
We mention for the master naut in the case of cloud providers so
Generally, it is managed by them, so there is not much that we are going to
be able to control or modify in that case the best practices of cubanet are
basically towards the components of the control plane as we configure the
nou master clean and server the controller and the skyler for the cid and
specifically, it is intended that it has authentication and that it uses certificates
that we just said that not that public and that somehow requires that no
It remains that it does not allow anonymous bass to obtain information the configuration of the
control plane is related to role file configurations and
audit mainly in the worker 'notes we also verify
node-specific configuration files and the club is not exposed
led who was the one who handled the posts and at the political level we have a wide
varied variety of policies we have airbag which is access control
based on roles that governors use we have service accounts we have post
security policies that allow restricting the execution of given pods
certain conditions the same may apply
at the network level with the network policies and we also have what is
secrets management
luckily we also have an interesting tool developed by
acro security that runs this benchmark for us both on master none
as in walker nou as I just said this as long as we are in a
environment that we fully control in the event that
we are running this in the cloud we could only run this analysis on the
worker now to get these results and this
also fortunately can be exported to jason to be analyzed
then we have tools like keep hunter that helps us see those
services that are exposed that we just mentioned that we are interested in
particularly the led club see if it is exposed if we can get information
sensitive to initially access a container
can also be contributed to jason as most tools are
Specifically that we are going to see, it cannot be exported but it is very useful.
tool that allows you to work on a fairly complex issue that is the
role management allows us to identify those who have
excessive privileges and adjusting according to the needs we have
then we have some tools that go beyond what is configuration
and that they already work at the runtime level, falco is one of them
allows to write policies to djamel files and these policies are controlled in
runtime if we see that there is any violation of the policy we can
take some actions for example destroy the pod
and there are other tools that allow us to thoroughly monitor
comprehensively what are system calls and other events
Well, up to now we have worked a lot on what is in better configurations
practices we take all the necessary measures to take care of our cluster
but sometimes this is not enough sometimes there may still be issues that
can make our containers end down
What can we do so that this plan does not fail? Well, we can go a little more
there on the official microsoft site there is a post that proposes a matrix of
attack for q vernet is based on maitre's attack matrix where he proposes
different techniques and tactics so that we can discover
and let's have a better view on the surface of attack vectors
that may have to see net is on the other hand what is the
management of network connections at the governing level secure connections
between potts is quite a complex issue and that is where the service comes to me
rescue basically the month service is an infrastructure layer that is
dedicates to making secure communications fast and reliable and gives us
understand us about such a complex task and the site is a project
opensource that makes an implementation of a service month uses the concept of
site car that basically within the pod itself runs a container that acts
as proxy the tool that makes the proxy is called dem boy and
This is administered from a control tower or control plane and is what
constitutes the service month then we have another interesting concept
what is open policy agent is an open source policy engine that
basically seeks to take off what is the definition of policies of each of
the components of our infrastructure is developed with a
declarative language called irrigation and can be applied to different
environment components such as microservices gubern etc after
ipiales even pipelines on their official site we have this image that we
can give an overview of each of the components where obvious and can
apply and the link you see at the bottom is a place where it is a play
ground where we can go playing with the different policies to understand how
works and integrates it with each of the
tools from our environment
We move on to the other layer, which is the infrastructure that supports our
cluster level cloud best practices each of the major
providers has its benchmark let's see let's compare details of some
of them in principle the one that more complete proposes its initial benchmark
asur covers not only the services in common that it has with the rest of the
cloud providers but is more specific in special considerations
security in platform as a service and for example if we see the google
cloud has what identifies the three plus some specific services of what
which is management companies and databases on ws although it seems that it is medium scarce
the initial benchmark has a secondary benchmark in which it works with
three-layer applications and goes deeper into what they are
doubles specific resource settings for each of
these tools for each of these of these tested ready some
tools are at the bottom so you can see later what
automations can be done on that and I would like to tell you a bit what
controls apply mainly what they have in common on
everything that is identity and access management talks mainly about
define the roles of the users who will use our cloud
to assign these users to groups to do a proper separation of duties
minimum privileges we have password policies we have the requirement of
use of multi-factor authentication that today many accounts are attacked
precisely because of weak passwords and the mf greatly reduces this area of
attack then we have at the networking level some differences between the cloud
providers for example asur uses a firewall concept that is unique in its
environment that is, it applies both to virtual machines and at the subnet level instead
aw is handled by one side of what are security groups to protect a group
of instances for example and the networks jesse els that are applied at the subnet level
then at the loving level and the different cloisters have different tools
give the possibility of sending blogs of applications blogs of the same
resources to be able to define alerts and even events that can with some
server tools will help you update configurations and lock
some attacks and also have action monitoring tools
specific about the cloud on the account for example making sure that
someone is not setting up an instance in a region that we do not want
that they are doing it or that they are not mining bitcoins in a machine
virtual etc. then for what is a premium
word is a provider that has the largest market share in what is servers
that are handled internally in the companies this is not exactly my area
of expertise but I did want to share with you some groups of controls that are
about this type of infrastructure that basically goes into how it is installed in
how virtual machines are managed from the console how to
configures each of the virtual machines how the
storage how loving etcetera is configured
well so far we have seen many many practical concepts
tools exits jason but what about this as like
we organize it how we give value to a company to a client or a manager to
tell him look we are doing this that seeing it this way it can be
really useful for making decisions good mayors
if it can be
they are seeing well there
cs
well then an alternative that I propose to solve this problem
is to centralize the information there is a tool that is free called
apache super being a smart business tool that works with
different relational database providers integrates with some
authentication providers like open haití and eldad and has a lot of power
for what is development of graphics and dashboards here you can see a screenshot
which shows a little the potential of this tool and in the case of
work it what I did in time was with some payton scripts to take
all these outputs from jason and feed his database which is a
sql dessert if you allow me, I'll take a second out of the presentation and
I show a little about this tool mainly what we most like
It would be interesting to see is this part of source is that it is where we are pulling each one
of the tables we can create our own tables or import from
other sources like files and esb and for example
in these tables we can in addition to what is coming
by default of the database make some definitions of how we want
that those fields are visualized well here punctually opening a table I can
for example make a graph by selecting
some metrics
node type for example
and I very quickly put together a graph, these graphs are recorded and then at the
time to record they can be sent to a damage and I want to show you
directly how is a dashboard armed and working in this case
we have the information of docker bench with each of the details of the
controls down here I am going to expand a little so that you can see it well by
What do I understand that it does not look good there
then we have what is the status of each of the controls and below the
detail of each of those controls then for what is static analysis
if you remember we ran a lot of tools on different
images I'm going to refresh it because when I zoomed in
I lost the images here
Well then here we have a graph in which we have the detail of the
vulnerabilities for each of the images we analyze
On the one hand we have a severity filter for example if you wanted to see
only the high severities of each of these images cool
automatically graph and detail below
and the same if you wanted to see something specific of an image that is filtered
automatically and in this way very easily we can play with that
information and finally I have this bng club which is the recurring ones if you remember
we have the master not and the worker nou the same we can filter by node type
to see below how the controls turned out and by type of severity or how
they gave us each of those controls we go back a little bit to the presentation
in these are the graphs that we were seeing and to summarize I want to leave you
some key ideas first important that when we have an architecture
complex we can define layers to be able together with the concept to say other
and make a defense-in-depth model where we distrust how
each of those layers is configured and we can not only rely on better
practices but out there to evaluate these configurations with some tools
external we can use sites like 620 to
take as a basis for these best practices we can take advantage of
these free tools to take care of the budget there are many tools that
applying the executing the already give us a security posture quite
complete without investing too much money and finally the fact of centralizing the
information can first provide you with the information and on the other hand help us to
convince our client or our manager so that he can
and finish making the appropriate decisions to take action on each
one of these findings that we made about our environment so good up to here
We arrived with the presentation, thank you very much for your attention and it was
available for questions thank you very much to the truth that it was
very good especially this last part of the centralization of information i
It seemed very interesting so let's move on to the questions section before
of that while they are sending questions I wanted to remind you that until 15
hours there is time to register in the draw in the drive and also at
end the echo the echo there is an audiovisual surprise right there in tweets stay
because it's going to be very good, that is, it's really going to be very good because
there are a lot of expectations about that so stay cool let's move on with
Let's see the questions we have here, no houses
between aw and google cloud which one are you commenting on
what good question good depends on the business needs they have a
An important item to consider as I was saying a while ago is that Google is the
cuber net developer is with which all that is to play minds is more
easy to manage from my point of view on google cloud and maybe
find that google cloud is simpler when you see twice the
number of services is overwhelming google cloud initially has less
services and a little easier to administer but it depends a lot on the
business needs double times also has very good services that
They cover other use cases and depends on what the specific needs are
Well another question can I know if what was installed uses an architecture of
container I calculate that this is an attack perspective seems to me what
are asking if what was installed let's assume on a host
a good container architecture as we mentioned docker there are some
other technologies, what should be done is basically go to the process level
and see if we identify any process that indicates that there is a technology of
containers running on that team well well well another question already
It is advisable to have two car containers deployed for applications
production or it would be better to use that vernet is good that depends a lot on the scale
as I was just saying, there are some organizations that run with a locker
compost that basically lifts two or three bins on a host and voila
then there are others that using car swan which is an intermediate is easy to
manage and is very attached to ado care and on a larger scale it does seem to me that it is
very important to think about that vernet is well well well another question we have
around here it is convenient to have an environment in
personal cloud is better to have it playmates or put it locally
good if it is personal it depends a lot if you have infrastructure to have something
local out there is better because it is not exposed to the world if you have it in the cloud
minimally you have to use a benchmark to ensure your account put
multifactor or make sure you don't expose credentials in your code a problem
common that you see out there is that there are people who write code and share it git
javi has the access keys twice and that can kill you
economically because they can run machines to mine bitcoins at
lifting hundreds of machines and then creating that account is priceless so
It also depends on the use case and how willing you are to apply controls
security for example if you are going to take something to the cloud
well another question which is how is the cycle
security development applies having des eaux to s & p rd
I do not know what are acronyms the truth maybe not acquisition of certain things solar
What did I mention but good to give shape to the question a bit
usually what is done is the tools of those that is analysis
Static software composition analysis ideally should be the
development of your life in case that does not happen when
send code to a repository and trigger actions that do
these checks and perhaps run some automated tool also from
dynamic analysis of applications that allows at least to identify the lou
hanging fruit which is called the most palpable risks by an attacker and then if
do a deeper analysis now with a pen test team maybe a tool
do an analysis and a little more detailed
ask a question that happened to me is this useful for cloud and on platforms
if you
to the point of infrastructure and there is the difference in the last
point that was the infrastructure layer between claudio premises in a prize perhaps
have something like good word then everything that is above that layer serves them
ruler can run perfectly on what is a prize
well how vulnerable are the
contents with respect to others require textures
It basically depends on the container configuration and it is one of the issues that
we just mentioned out there and you are running a container as root
and someone manages to access that contain because your application had many faults
Security is likely to be able to escalate access privileges by touching
tell us or agree that the governing lands and others then the security
It is given in principle from the image from the template of how
we configure that image of the application that runs that image and then if I'll go
more in detail to the settings at the docker level and at the governing level is
perfect well we have one more there are several more appears in your experience
which do you consider more secure voice than the cipher to implement rp a
rp let's see what i guess
no no I don't know what he refers to that tells us that we are going to wait for him so that
tell us we have another
What do I do to you? Let's say that the doubt arose
when you download, for example, an educate image from the dow, I think you have
happened that you have found that I had more security and that image
it was deployed for example in a lot of places it already had containers
And how did you do to solve it? Let's say well, well, yes, it happens and it happens
a lot for example when when we download some knut images
to run a back in those that were based on debian if it ran to some
tool like tribe and found a lot of vulnerabilities in that image
and then you had some alternative like the same image again based on 'the
paint and that perhaps did not have vulnerabilities so it is important
that when choosing which image to use as the basis for our application to be able to
compare different versions that maybe we can run the same and without
vulnerabilities well well well here they are not saying that rapping would be
process automation can be ok yes
well I do not have the knowledge of the acronym but well basically all this
that we describe can be integrated into a continuous integration pipeline there
lots of tools this island sucks jenkins
they cover different stages islands out there is more complete if that is the question
I think the answer is out there and we will try to integrate with those
tools and include controls and automate on those tools
fine fine yes yes I think that points to what automated security tests
you run in your container architecture
Well, all these tools that we were looking at, we started with the
doctor bench in him then we go to what is vernet is the static analysis
of club ruling images in the hunter club where they search for the
issue of controlling the roles and well after the host configurations
It is also important the issue is not less, for example in the machines
virtual ones that run in amazon a provider club to see that the ones that are not
exposed credentials in environment variables that when entering that host
we have full access to the cloud practically through the queue and
we can take full control of an account from
w is then a bit of everything, let's say there are many tools and even for
The cloud benchmarks we saw that there are also some so I recommend that you
run as many as you can and take out your doubts to see if there are false
positive or not and if they can do manual tests of things that are not
in those tools they are also asked another question
you can have double environments and help in the same application coexist
controls of the two platforms
The question is rare but you can have a cluster of cuber minds in asur
and a recurring cluster in the WS and that there is external communication through
Those applications that you can and well later within each account
you can have my pool isolated that in turn communicate internally and not
go abroad there are many options to make those configurations
it would be necessary to see which is the one that best suits the use case
good good good in your experience because you think there are more attacks in the registry
from docker
and good because touching hub is a place where images are downloaded
there are millions of image downloads continuously and we can find people
that you even put malicious images in there so that's why it's
important is the concept of finger that you concentrate that when one develops
of images for your company try to sign the and when at the time of
download them also check that signature to validate the integrity of
those images make sure that we are always using the image that actually
we intend to use well here a user tells us
brawn of ex management regarding the management of secrets if in the end the instance of the
doctor can see the secrets are safe to use tools like bowls
the tool can take them at execution time which is not the same as
are exposed as environment variables then if it is safe to use
tools as good
j some experiences with openshift not in my case I have no experience with it
principle because you think there is no
more secure settings by default
good happens for example when we want to build a server in the cloud
a double times for example facilitates with default configurations that
quickly we have it working but that also has a negative impact on the
security of our application then it is important not to stay with the
default settings that usually both cloud providers
or the manufacturer of a certain product what you are looking for is that your product
starts to use quickly but this does not necessarily mean that it is
you are using safely then it is important to apply our controls and
harden hoist her up somehow very well very good any more questions
I think we are good, thank you very much Alfredo, it is true that he was dead
before I loved it properly I liked it very much so good I know why
because this continues thank you very much