Kubernetes enables you to run containerized workloads at scale on a cluster of virtual machines, while AWS Fargate offers a flexible way to run containers without having to manage servers. What are the best ways to protect these workloads against attacks? In this demo-rich chalk talk, including a live exploit, we explore how techniques like image scanning and runtime protection tools can provide innovative ways to control and secure your containerized applications, even when there is no way to directly access the hosts that they are running on.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Runtime Security across
Kubernetes and AWS Fargate
Liz Rice
Technology Evangelist, Aqua Security
@lizrice
C O N 3 1 7

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Avoiding vulnerabilities in container images
Beyond vulnerabilities to zero-days
Building enforcement into a container wherever it runs

4. Known vulnerabilities in dependencies
are the most common route to
compromise and exploitation

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Scan container images for vulnerabilities

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Scanning as part of the build
FROM wordpress:demo
COPY microscanner /microscanner
ARG token
RUN /microscanner --html ${token} > /ms-out.html
docker build -f Dockerfile.wp --build-arg=token=$TOKEN .

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Stop unexpected behavior at runtime

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Container deployment options

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcement built into the image
FROM wordpress
COPY microenforcer /microenforcer
COPY wp-policy.json /etc/aquasec/policy/policy.json
ENTRYPOINT ["/microenforcer", "apache2-foreground"]
docker build -f Dockerfile.wp .

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcement as part of the task definition / pod
Application
container
Sidecar container
Task Definition

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. A full-day Summit focused on enterprise-level
Kubernetes deployment with demanding
security requirements.
aquasec.com/kubesec2018

15. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Liz Rice
Aqua Security
@lizrice

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.