Is your deployment in pants-down mode? Jason Rouault, CTO Cloudvisory

Pants Down Mode?

© 2018 Cloudvisory - Confidential The Problem: Incomplete Security Governance in Hybrid Multi-Cloud Environments Risks & Challenges in Public/Private Cloud Providers and Legacy Infrastructure Cloud environments are “black boxes”. How can I gain visibility and improve my security posture? Cloud-native security controls are often misconfigured. How can I detect, alert and remediate configuration errors? Cloud and legacy workloads are left too “opened”. How can I consistently enforce least privilege security and decrease the attack surface? Attacks in both cloud and legacy environments are often undetected until it is too late. How can I detect/alert, block and quarantine these attacks? Cloud self-service brings agility to the business, but introduces new risks. How can devops, security, audit, risk and compliance teams maintain control without slowing-down the digital transformation? Visibility Do you have a visual representation today of your entire cloud infrastructure (Providers, workloads, security groups, data flows, etc.)? Things get complex quickly when dealing with multiple environments (dev, test, prod, regions) and multiple providers (data center, OpenStack AWS, Azure…) Black Box for security teams. If an application were down because of improper policy, do you have a way to visualize and identify in real-time? Key is maintaining the agility and flexibility that a self service cloud provides, but also providing the necessary security controls Multiple environments (test, dev, production) Multiple providers (datacenter, AWS, Azure, GCE, and OpenStack) Control Security controls can be complex to the uninitiated, and then can be easy to get wrong Since security controls are applied per VM, it can be quite a daunting task to manage them for large deployments Ideally security policies would get dynamically applied their workloads, rather than the current staticly. Who deploys cloud security controls (Native UI or Scripts) today? DevOps, Security? And how is this enforced Compliance If policies are accidently or maliciously altered, impacting risk or applications, could you detect and how long would it take to repair? If malware compromised a virtual instance today how long would it take to identify the issue and remediate back to compliant state? “Lift and Shift” of legacy security tools to the Cloud will NOT improve Security Visibility, Compliance and Enforcement © 2018 Cloudvisory - Confidential

Start with a Secure Configuration OpenStack Security Checklist https://docs.openstack.org/security-guide/checklist.html © 2018 Cloudvisory - Confidential

Automated OpenStack Security Checks Continuous checks and reporting are needed Compliance Check Automation © 2018 Cloudvisory - Confidential

Compliance is not a one time event Demonstrate Compliance over time Historical Perspective © 2018 Cloudvisory - Confidential

Tailored Views into Compliance Example OpenStack Security Checklist © 2018 Cloudvisory - Confidential

Tailored Views into Compliance Example CIS Kubernetes Benchmark © 2018 Cloudvisory - Confidential

© 2018 Cloudvisory - Confidential Ad-hoc Audit Queries Single Pane of Glass to Manage Risk: Audit, Check and Enforce Compliance Policies © 2018 Cloudvisory - Confidential

Create Guardrails for your self service users Custom Compliance Checks Auto Notification Auto Remediation Full Audit Trails © 2018 Cloudvisory - Confidential

Visualize Your Hybrid, Multi-Cloud Environment Automate cloud-native micro-segmentation © 2018 Cloudvisory - Confidential

Least-Privilege Enforcement Cloudvisory Security Platform (CSP) © 2018 Cloudvisory - Confidential Hybrid, Multi-Cloud Security Governance Lifecycle Management Actionable Audit Auto-Discovery of workloads, network flows, meta-data and cloud-native firewall rules Ad-hoc auditing and reporting Diagnosis of network security issues Discovery of least privilege rules needed for micro-segmentation Compliance Assurance Continuous monitoring to detect and alert on cloud-native & operating systems firewalls misconfigurations Continuous monitoring to detect and alert on lateral moving attacks Custom, Network & CIS Compliance check monitoring, alerting & reporting Least-Privilege Enforcement Hybrid multi-cloud micro-segmentation policy orchestration & enforcement Push button and automatic compliance policy remediation © 2018 Cloudvisory - Confidential

© 2018 Cloudvisory - Confidential The Journey: Hybrid Multi-Cloud Security Governance Non-Intrusive Cloud Security Audit, Compliance & Enforcement © 2018 Cloudvisory - Confidential

Cloudvisory Security Platform Current Release Hybrid Cloud Security Governance Audit, Compliance & Enforcement © 2018 Cloudvisory - Confidential