Security Symposium New York, 2018

Morning keynote: Why we are still losing the InfoSec battle and how do we get back in the race?

9:30 a.m.-10:30 a.m.

Steve Orrin, federal chief technologist, Intel Corporation

In the current security paradigm, security teams are losing to threat actors and falling further behind. We need novel approaches to reducing the threat curve by integrating solutions across cyber threat intelligence and analytics, continuous monitoring, automation, and information sharing. Analytics and Machine Learning have had a transformative impact on threat intelligence. It’s a paradigm-shifting improvement as-is, and its impact can be further augmented by the application of foundational security hygiene, continuous monitoring, information sharing, and automation. These key elements working in concert will change the security landscape from its current gradual pace to a much more rapid rate of improvement and risk reduction. The session will highlight strategies, innovations and illustrate how we as a community must come together to meet the evolving threats and risks to organizations, users and our data.

Back to top

Afternoon keynote: Container Security and new container technologies

3:30 p.m.-4:20 p.m.

Dan Walsh, consulting engineer, Red Hat

This talk will update the latest state of container security technology and cover new container technology and how it enables some of these features.

It will explain all of the parts of the OS that are being used to control what containers can do on a system.

• Read/Only system mounts, SELinux, User Namespace, Seccomp, Cgroups.
• OpenShift concept of running containers as non-root by default.

It will introduce new tools including CRI-O, buildah, podman for running containers. And new features in these tools to run in a more secure mode.

CRI-O - A container runtime for running kubernetes workloads.
Security Features:

• Read-only node forces your kubernetes environment to only run containers that can not modify their images.
• User Namespace support.
• Simplified Kubernetes Container Runtime Interface.
• Kubernetes Dedicated Runtime, Smaller Simpler daemon, only functionality required by Kubernetes.

Podman:

• Replacement container runtime CLI for Docker.
• User Namespaces Support.
• No bigfatdaemon listening for incoming connections.
• Simpler fork/exec model of running containers versus Client Server.
• Better Auditing.
• Mount - able to mount container images for examination by scanners.

Buildah:

• No bigfatdaemon listening for incoming connections.
• Less privileged mode, able to build inside of a container.
• Able to build much smaller container images, no need to have build artifacts in your container images.
• Mount - able to mount container images for examination by scanners.

Skopeo
Support for multiple container storages including:

• Container runtimes, docker storage, container/storage for sharing content with CRI-O, Buildah, Podman.
• Converting from Docker image format to OCI Image format.
• Remote inspection of container image json.

Back to top

Overview of the security technologies in Red Hat Enterprise Linux

10:45 a.m.-11:35 a.m.

Dmitri Pal

Red Hat Enterprise Linux includes a variety of technologies that allow customers building layers of protection of their datacenter and working towards meeting compliance requirements. The presentation will give a high level overview of the available and emerging technologies like OpenSCAP, SELinux, Crypto, Policy Based Decryption, USBGuard, Identity Management and others and will provide pointers and references available materials for further reading.

Back to top

Application whitelisting and automated threat response

11:35 a.m.-12:25 p.m.

Steve Grubb

Application whitelisting is an effective way of preventing unknown software from executing on a machine. This presentation will detail an open source implementation that is available in Fedora. We will also look at how the information from an application whitelisting daemon can be leveraged in real time to maintain system integrity. An overall strategy will be outlined showing how this piece fits into a broader security context.

Back to top

Secure Application Connectivity: Dynamically Securing OpenShift Workload Communications at Scale

1:30 p.m.-2:20 p.m.

Cody McCain

Orchestrated workloads, and by extension, their network identities are ephemeral. This coupled with peer-to-peer topologies proliferated due to microservice adoption is rendering traditional and static network security devices irrelevant. This session demonstrates distributed and just-in-time policy rendering that protects workloads across layers 3-7 of the network stack. We will also discuss how to compose, manage and operate micropolicies in an OpenShift and cloud-native world.

Back to top

Automating security and compliance for hybrid environments

2:30 p.m.-3:20 p.m.

Lucy Kerner

Maintaining visibility, control, security, and ensuring governance and compliance remains paramount. However, it becomes more difficult and time consuming in a hybrid infrastructure consisting of physical, virtual, cloud, and container environments. In this session, you’ll learn how a combination of Red Hat CloudForms, Red Hat Satellite, Red Hat Insights, Red Hat Ansible Automation, and OpenSCAP can help you with these challenges in your hybrid infrastructure by automating security and compliance. Specifically, in your hybrid infrastructure, you’ll learn how to easily provision a security-compliant host, how to quickly detect and remediate security and compliance issues, how to ensure governance and control in an automated way, how to do proactive security and automated risk management, how to perform audit scans and remediations on your systems, and how to automate security to ensure compliance against regulatory or custom profiles.

Back to top

Secure Application Authentication with Red Hat SSO

10:45 a.m.-11:35 a.m.

John Doyle

Ensuring the required secure authentication and authorization policies are applied to web applications is a critical task. Red Hat Single Sign-On provides the capabilities to centrally manage the users, groups, roles and permissions for your applications via standards developed for the web like OAuth and OpenID Connect, in both traditional and orchestrated environments. This session will cover the core capabilities of Red Hat SSO including password policies, user federation, identity brokering, and social login.

Back to top

Security first: Automating CI/CD pipelines and policing applications

11:35 a.m.-12:25 p.m.

Justin Goldsmith

Recent public breaches highlight the importance of a security strategy that extends beyond the network perimeter. Applications developed and maintained without security in mind present a likely entry point for malicious attackers. Preventive measures should be taken to reduce vulnerabilities that can avoid zero-day attacks.

As organizations adopt containers, an automated approach to security, testing, and application development is needed to increase productivity and reduce risk.

During this session, you'll learn how the Red Hat OpenShift Container Platform can be used to:

• Integrate security monitoring software into CI/CD pipelines for containerized applications.
• Know what's in your containers and where they come from, which is vital to secure and quickly remediate workloads.
• Enhance open source library security, in true DevSecOps fashion, and establish a security-first mindset for application development.

Back to top

Charting the course of API security over time: past, present and future

1:30 p.m.-2:20 p.m.

Yossi Koren and Kavitha Srinivasan

The API Security Journey
From local to federated model

Security Approach & Strategy
Evaluate your API needs

Best Practice & Trends
Form API Keys to OpenID

The API gateway model
Native, Docker, OpenShift & Plug-in approach

API Security Outlook (TBD)
Security Roadmap

Back to top

Go faster but check your brakes - serverless security

2:30 p.m.-3:20 p.m.

Rich Sharples

Serverless is rapidly gaining a foothold in the developer's toolbox and promises extreme scale and efficiency while speeding up development of modern cloud-native applications but it does require that we think about security a little differently. Contemporary distributed applications (including traditional long-running microservices and serverless) give the malicious attacker (or inattentive developer) new opportunities to wreak havoc. This session will present some of the considerations and what to do about them.

Back to top