[MUSIC PLAYING]
DUSTIN KIRKLAND: Hello again.
I'm Dustin Kirkland.
And I'm here with Maya Kaczorowski.
She is the security product manager
for Containers at Google.
MAYA KACZOROWSKI: That's right.
DUSTIN KIRKLAND: And we're going to talk
a bit about the security angle here at KubeCon.
And I think she's got a pretty exciting announcement
from earlier today.
MAYA KACZOROWSKI: Yeah.
That's right.
So Google Community's Engine information about clusters
are now included in the Cloud Security Command Center.
The Cloud Security Command Center
is our single pane of glass for figuring out
what's happening in your projects
from a security point of view.
Think about it as security monitoring,
rather than, say, application monitoring.
And now you can see what's happening for those GKE
clusters right in cloud CSCC.
What's really exciting about that
also is that we have five container security partner
integrations natively in GKE in Cloud Security Command Center.
DUSTIN KIRKLAND: Can you name all five?
MAYA KACZOROWSKI: Yes.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: Aqua Security, Capsule 8, Stack Rocks,
Cystic Secure, and Twist Lock all
can now write their findings directly
to the Cloud Security Command Center
for what you're running in GKE.
DUSTIN KIRKLAND: Now, is that run time?
Or is that at build or developer time?
MAYA KACZOROWSKI: Sure.
So we think about container security
at Google in three different aspects.
One is what we'll call making sure your containers are
secure to develop.
So do I have some way of managing my network policies,
and secrets, and different kinds of deployment policies,
identities, et cetera that I'm going to have.
The second area is what we'll call build and deploy
securities.
So how do you know that your images are vulnerability-free,
don't contain 0-days, that they've
gone through your CICD pipeline before they
deploy to production.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: The main thing that we have in that space
right now is something called Grafeas.
It's an open source project.
There's a couple talks, actually, at KubeCon on Grafeas
by the TL of that project, Wendy.
And that allows you to track the metadata of your projects,
including vulnerability scan results for those images
so you can then determine whether or not
you can deploy those images.
DUSTIN KIRKLAND: Kubernetes at large,
it seems like there's a lot of work that's
gone into more secure images without zero days.
It seems like something that we've really
got to get on top of, right?
MAYA KACZOROWSKI: It's certainly an area
with a lot of low-hanging fruit.
And there's a lot of customer and partner
interest in that space.
The main problem to solve in that space right
now is just the sheer volume of vulnerabilities
that people have.
So I've had customers ask me, what
do I do if I find a vulnerability that doesn't
have a patch that exists yet?
And the reality is, you're probably
thinking too far ahead.
You probably have a ton of vulnerabilities
that are completely unpatched.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: Fix those first
before you start to worry about things that are unpatchable.
DUSTIN KIRKLAND: So is the best advice
we have to give is rely on the operating systems vendors
to provide those updates, and just make sure
that those updates are as installed as possible in all
of your base images?
MAYA KACZOROWSKI: So you're thinking
of actually a different layer than what I'm thinking of.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: So you can talk about the node OS
and the container OS.
And Google uses container optimized OS
as the node OS, which was open source.
It's based on Chromium OS.
And we have a great blog post as to why
we think that's built in a really secure way.
And then you can use the container OS.
And we have lots of options, again, on Google.
Or you can bring your own.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: And then we have the image itself
that you're deploying.
And that might itself have vulnerabilities.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: So if you're running NGINX, or WordPress,
and that's a two-year-old image, maybe you want to patch
that before you deploy.
Maybe you want to check the age of your images.
Maybe you want to run some standard scans, et cetera,
before you deploy that.
DUSTIN KIRKLAND: And which of those
is the user's responsibility, versus Google
takes care of on your behalf?
MAYA KACZOROWSKI: Sure.
If you're using a node OS or a container OS,
it's provided by Google.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: It's Google's responsibly to patch it.
But it's your responsibility to pick what you want.
DUSTIN KIRKLAND: OK.
So the user picks.
MAYA KACZOROWSKI: Correct.
DUSTIN KIRKLAND: And then Google handles
the patching of the base OS as a managed service effectively.
MAYA KACZOROWSKI: If they pick an OS that we provide.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: So if you choose
to bring your own container OS, then it's
your responsibility, obviously.
The image itself is your responsibility to secure.
DUSTIN KIRKLAND: OK.
But this single pane of glass now
should maybe help users a bit more?
MAYA KACZOROWSKI: Ah.
So that's the third area.
So that's our container runtime security
area, which is, I have a container now running
in production.
And I've done everything I can to fiddle
with all the things in GKE, and scan my images before they're
deployed.
But what if there still is an 0-day,
and what if somebody gets into my container
and starts doing something bad?
How do I detect that, react, do forensics
after the fact, et cetera?
DUSTIN KIRKLAND: Yeah.
MAYA KACZOROWSKI: And that's container runtime security.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: And that's a super nascent
space, an area we realize there's a lot of interest in.
Hence, the integrations of five partners with the Cloud
Security Command Center.
DUSTIN KIRKLAND: Right.
And are any of these helping us with forensics?
I'm guessing that's snapshotting the container,
knowing what it looked like at various points in time,
maybe being able to roll back debug logs or monitoring
logs, and--
I don't know-- trace the origination of the attack?
MAYA KACZOROWSKI: That's a still fairly new capability.
DUSTIN KIRKLAND: OK.
Wishful thinking, right?
MAYA KACZOROWSKI: Yeah.
A lot of the partners have tooling around
a longer set of logs.
So you might have logs that are written temporarily,
to like a ring buffer, for example.
And then once you detect an incident,
you flag those logs and start writing those.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: It's not necessarily full image
snapshotting that's happening yet.
DUSTIN KIRKLAND: Right.
That's where we're at today.
So we covered the three different areas.
I'm curious if there are kinds of attacks
that you'd like to maybe highlight?
The types of things that either developers
should be aware of when writing an application,
or IT administrators should be aware
of as their operating clusters?
MAYA KACZOROWSKI: Yeah.
I mean, it's, in some sense, it's kind
of boring for a security professional.
It's not that different than what you see as attacking a VM,
right?
You're going to see credential theft, privilege escalation.
You might see abuse of compute.
In this case, crypto mining's a fairly popular thing to do.
They're not new kinds of attacks.
And often people are actually not
aware that they're in a container
when they're [INAUDIBLE] attacks.
They're not attacking Kubernetes per se.
They're just attacking some open compute thing.
And oh, I happen to be in a container.
That's great.
DUSTIN KIRKLAND: Indeed.
Interesting.
So different question.
Moving away from security a little bit.
Just looking at the community, the at large community
around Kubernetes, are there maybe
any people, individuals in the community that you'd
like to recognize as someone who inspires you, has maybe
helped you out, or helped out the project
in the last few months?
MAYA KACZOROWSKI: Yeah.
I think we're really fortunate in security.
Everyone who's involved in [? CIGOFF ?]
is really a stellar, stellar individual.
I'd like to call out Eric Chang from Red Hat, [INAUDIBLE]..
He's been really great at doing a lot of the IEM [? R-back ?]
type work in Kubernetes.
If you want a good description of [? R-back, ?] go talk
to Eric.
He will explain it to you.
DUSTIN KIRKLAND: I was just about to ask you.
MAYA KACZOROWSKI: 30 seconds or an hour long,
depending on what you like, and what he does or doesn't like
about [? R-back. ?]
Eric's also been leading a lot of the thought leadership
in [? CIGOFF. ?] So he's been really great to have
to have him involved.
DUSTIN KIRKLAND: Yeah.
That's great.
Then finding, finally, one last question.
Can you tell us-- people are super interested-- how
you got into Kubernetes?
What was your introduction to Kubernetes?
MAYA KACZOROWSKI: People are not super interested in this stuff.
DUSTIN KIRKLAND: No.
They're very, very interested.
MAYA KACZOROWSKI: I'm a very pragmatic person.
I worked in security for a while.
And I wanted to work on something
that I thought was going to 10X in the next five years.
Containers are going to 10X in the next five years.
There will be security problems.
DUSTIN KIRKLAND: There you go.
MAYA KACZOROWSKI: And also job security.
And ideally, we can prevent those security problems
before they happen.
DUSTIN KIRKLAND: All right.
Well, good.
Well, thank you very much.
MAYA KACZOROWSKI: Thank you.