[Music]
hi everyone i'm gordon half technology
evangelist at red hat and i'm here with
my colleague lucy today to talk about
security
lucy can you please introduce yourself
hi everyone
my name is lucy kerner i'm the security
global strategy and evangelism director
at red hat
my lead security thought leadership the
technical go to market strategy
messaging and evangelism for security
across
red hat's entire portfolio globally
lucy i'm sure some of our viewers are
very familiar with open source
software others maybe a little less so
so i'd like to get one thing out of the
way up front how can open source be
secure
if potential attackers can scour the
source code looking for weaknesses
and anyone can generally submit changes
to that code
yeah great question gordon so you know
open source you know brings that those
advantages
um you know such as access to the latest
innovation transparency
collaboration cost savings you know
potentially higher
quality software since more eyes are on
the code but you really need to put
safeguards in place to consume open
source securely you know
especially now like organizations are
consuming cloud technologies
um more and more right and oftentimes
this means giving developers more and
more control of the full development
life cycle
if they're able to download images from
directly from the internet or
they're able to use container security
tooling directly you know things like
this
spin up amazon instances but developers
aren't
security experts so this can lead to
challenges if mitigations aren't in
place
um and it's associated if they're not in
place so for example
about three years ago tainted crypto
mining uh
container images from docker hub were
downloaded um
i think it was like over 5 million times
or even more recently the solarwinds
attack
and so many companies decide to download
and use open source software
in fact that that's a huge part of their
you know the software they use um you
know they want to save time and
uh money and as opposed to buying
commercial software based on open source
projects um they figure they may figure
that you know
what they give up in security they're
getting um for
they're getting that uh make making it
up with cost savings and agility
and so while that may be true if you
decide to do that
make sure you have you do the following
so number one
you know have a method for inventory the
scope of open source usage in your
organization you know
have the ability to assess the security
impact of each vulnerability
you know have the resources in place to
quickly find and fix vulnerabilities
and quickly i update all the affected
systems as the latest
version um that includes the fix uh make
sure you know like which vulnerabilities
does
matters and which ones are like security
researchers just trying to make
themselves famous at black cat
just because it has a famous name it
doesn't mean that it's it's something
you have to worry about
you put a sdlc a secure development
lifecycle in place
where you're regular doing regularly
doing things like
code and vulnerability scanning
extensive quality engineering testing
per release
and so the reality is that even though
many projects
upstream has some testing systems for
code submission and merge
it's far from ideal when we look at
enterprise grade quality and security
upstream projects usually have very
narrow testing scope to do to the most
simple
configurations definitely not enough to
scale and
they do most like basic basic hardening
of servers are applied
um and these uh and more make upstream
um
testing good for like first level
testing uh but
definitely not enough uh to satisfy
enterprise needs
so lucy you sort of alluded to how
organizations are transitioning to
public clouds to hybrid clouds and the
fact that you're just
using more open source software
this is a new world um how should we be
tackling security differently
yeah great question so um as as you
stated you know as more organizations
are moving to
um introducing new technologies that
hybrid cloud and cloud technology
springs
um in addition to what we talked about
uh making sure that you're consuming
open source technology securely because
all of these technologies are open
source
as well uh many of them at least right
we talk about like kubernetes for
example right so
some of the challenges organizations
organizations face include the
challenges that organizations face when
introducing any new technology right
so you want to make sure to do things
like bring your security teams early in
the evaluation
process of you know which cloud
technologies organization should
should adopt that way you're you're
figuring out how to secure hybrid cloud
environments um
in a proactive versus bolt-on which also
from many times what i've seen uh
organization struggling with securing
cloud and hybrid cloud
uh we're also struggling on premise so
for example misconfigurations it's a
leading cause of
breaches out there including cloud
security breaches however
this is this is uh not really done in a
proactive way in many organizations so
uh you make sure that you have a
strategy in place
to tackle these low-hanging fruit issues
like misconfigurations
um you do it do things like automated
config management and
codifying configurations uh make sure
that uh you're doing things like
what we talked about mitigating software
supply chain risks by having a strategy
to consume open source software up
securely you know have a strategy for
data security and managing and
protecting and getting visibility to
that data
of maintaining that compliance and
governance the hybrid cloud because
security policies that may make sense
in your physical and virtual environment
does not make sense all the time in a
cloud environment so you need to
evaluate that and you need to codify how
you do compliance
um you know you want to manage and have
visibility in a hybrid cloud environment
as well do things like integrating your
visibility tools into a sim
uh move to identity centric model like
aws cso has said
you know perimeter-based security does
not work in the cloud identity is the
new perimeter
um you take a hard look at the security
toilet you and practices you have in
place
uh while it may make sense have made
sense of the physical virtual
environment
it may not make sense in a cloud
environment like i was at a one customer
healthcare customer who um you know was
using a
traditional tooling to manage their
containerized environment where
containers are coming up and down and up
and down and they were trying to track
ip addresses right
that kind of tooling and methodology
does not work in a cloud environment so
you need to
really take a hard look at the tooling
and practices you have in place
you want to scale management because
there's so many things you have to
manage you can't
you has to be in an automated manner you
want to implement an automation strategy
everything in the cloud is automated so
you need you want to make sure you have
an automation
strategy that's consistent across the
organization and so that you are
tackling
common human error such as
misconfiguration issues
you tackle don't forget about securities
about not just technology and
tools it's about people and process so
you want to make sure you have a
strategy to
tackle the people in process problem for
securing hybrid cloud
and by by not just throwing more bodies
at the problem
as well so you you mentioned data
and i think sometimes we think about
the code in the case of open source a
lot but
it's also very important to protect
and manage that data particularly in
this a distributed
hybrid type of environment tell us a
little more about that
yeah definitely you definitely have a
strategy for protecting and managing
gaining visibility to that data like so
first of all find out you know where
does that data actually reside
in your environment decide is that the
right place
for that data to be stored another thing
important to do is to categorize that
data
categorize it into low medium and highly
sensitive
so i've seen actually some organization
um delegate less sensitive data to the
hybrid cloud
i'm sorry to the public cloud and then
highly sensitive data to the
their private cloud or their on-premise
environment so eve but even less
sensitive data in the in your
public cloud should be secured as much
as possible you don't want to
end up like there's this one big
financial institution who put
their data on aws s3 storage
that led to a data breach right it had
all of their sensitive customer data on
it
and it was actually just posted on on
their personal on the hacker's personal
github page
which the organization never found out
until they got a per i i um
anonymous email from into in their um
that's
sent by security researcher right so you
don't want to be in that situation you
also um
you know make sure that you're
leveraging all of the uh vast security
tooling by
uh you know your public cloud service
provider uh for example you know they
have
tools like data tagging data
notification key management service
aws for example has a centralized
security console called security hub
take advantage of existing technologies
you already have like for example your
operating system your operating system
um has things like access control lists
for example um
for example we uh we have in in um
enterprise linux has as
access control lists and encryption and
data security uh for
to address these data security issues
look at things like enabling access
controls things like sc linux things
like
encryption for data at rest for a lot
with logs
look at things like encryption over the
wire with tls and ipsec
make sure that your secrets are
encrypted within the cloud and within
your application as well
lucy you mentioned financial services
which is sort of a classic example
of a regulated industry how do those
kind of industries and others
maintain compliance and governance
right in a hybrid cloud especially right
you want to look at the policies um
hybrid cloud cloud look at the security
policies you already have in place and
see if it makes sense in a
cloud or a containerizing kubernetes
environment a classic policy that many
organizations and
have to comply with that's in many
security standards out there
is you know um but you must install
antivirus
on all your systems this may make sense
in a virtual and physical environment
but it does not make sense in a
containerized environment
uh where the container host itself is
immutable
um also just like you're doing um you
should be doing infrastructure and
security as code maybe for that you know
that for that consistency that
repeatability that auditability
you want to make sure you do compliance
as coda as well
um that way you're codifying and
automating the way you're doing
compliance at scale for both
um auditing and remediation
sort of at the beginning you mentioned
about people and process
challenges especially as it relates to
hybrid cloud
and processes like devsecops
can you elaborate how organizations
should tackle these challenges
yeah so you know security is not just
about products and technology
right it's a people process and
technology problem that's a famous quote
actually from
bruce nye right american cryptographer
so
you want to tackle the cyber security
research problem not just by throwing
more bodies
at the problem but tackling it across
people process technology
cloud security architects and engineers
are probably one of the hardest
actually they are one of the hardest
resources to hire today
and build a cyber so do things like
build a cyber resilient team
um by growing your cyber security
resources you know from within by
further developing your existing i.t
and development for and it professionals
um
develop that crop culture of cross
collaboration
cross training across the organization
have the developers
teach the security teams and vice versa
have lunch and learns
i've seen some secure some organizations
do things like i'll go to escape rooms
together to resolve
security challenges you know uh also
implement that
a consistent automation strategy like we
talked about because you want to get rid
of those repetitive tests
that lead to human error that lead to
problems like misconfigurations which
are the leading causes breaches
um and also all of this uh doing all of
this
is is is is actually taking that baby
step
approach to do devsecops success
successfully and actually making it real
um in your organization so how else can
you scale your teams uh more and more
these third-party security vendors are
adding things like
ai and ml technologies to automate
things you may be doing your security
operations center
organizations are also leveraging um
third-party
service providers such as cloud managed
service security
cloud managed service providers and also
security managed service providers to
augment
augment their security and cloud staff
as well
well thank you lucy yeah thanks gordon
chris great thanks for the conversation