Download as PDF, PPTX
Secure Your Kubernetes Apps from Attacks with NGINX
- 1. Secure Your KubernetesApps from Attacks with NGINX Thelen Blum – Sr. Product Marketing Manager, F5 NGINX Amir Rawdat– Technical Marketing Engineer, F5 NGINX
- 2. ©2022 F5 2 Agenda Modern Applicationvs. Security Adoption Rates The Cost of a Breach Why Modern Application Security Needs a WAF How to Easily Secure Your Kubernetes Apps with NGINX App Protect WAF and NGINX Ingress Controller Demo Q & A
- 3. ©2022 F5 3 APP PORTFOLIOsGROW AND MODNERNATION CONTINUES WITH MULTI-CLOUD DEPLOYMENTS How Many Apps do Most Organizations Have Today? Source: F5 State of Application Strategy Report 2022 - up 31% from 5 years ago 77% of those surveyed run apps in multiple clouds with 95% modernizing older applications.
- 4. ©2022 F5 4 MORE THANTWO-THIRDS OF ORGS ARE USING AT LEAST TWO METHODS TO CREATE MODERN WORKFLOWS Application Modernization Continues to Rise - over 2020 Source: F5 State of Application Strategy Report 2021
- 5. ©2022 F5 5 CONTAINERS FOUNDTO LACK SECURITY DUE TO CODE AND CONFIGURATION VULENRABILITIES Web Applications Remain a Top Attack Vector Source: Forrester, The State of Application Security, 2021
- 6. ©2022 F5 6 HOW SECUREIS YOUR ORGANIZATION? The Severity of Recent Security Breaches • 2021 Vulnerability in Java logging library Log4j • Remote Code Execution / attacker full sys. access control • Still over 90,000 internet facing apps and 68,000 servers still publicly exposed • 2021 Facebook Data Breach of 533M individual’s personal information • Data scraped from Facebook servers • Due to a misconfiguration error • 2017 Equifax Data Breach of 147.9M individual’s personal information – 40% of the US population • Thought to be State Sponsored • Started due to a known vulnerability that was never patched
- 7. ©2022 F5 7 INCREASED BYTHE LARGEST MARGIN IN SEVEN YEARS The Average Cost of a Data Breach up 10% from 2020 Source: Ponemon and IBM Security Cost of a Data Breach Report 2021
- 8. ©2022 F5 8 MOST SIGNIFICANTCOST SAVINGS IN THE 2021 IBM COST OF A DATA BREACH REPORT Security Automation and AI Reduced Breach Costs by 80% Source: Ponemon and IBM Security Cost of a Data Breach Report 2021
- 9. ©2022 F5 9 Software Vulnerabilities& Common Attack Vectors SOFTWARE VULNERABILITIES IN APPLICATION STACKS (CVEs) Software vulnerabilities are found in components of virtually all software stacks • Operating systems (Windows, Linux, containers) • Application servers • Support libraries • Programming languages • 3rd party libraries (NPM, CPAN, Ruby Gems) Threats such as Injection and XSS are well known, but difficult to mitigate, thus remarkably common • Injection • Cross Site Scripting • Cross-site request forgery • Insecure deserialization FREQUENTLY OCCURRING WEAKNESSES IN APPLICATION CODE (OWASP Top 10)
- 10. ©2022 F5 10 What’s aWeb Application Firewall (WAF)? ENABLE PROTECTION AGAINST APPLICATION LAYER 7 ATTACKS
- 11. ©2022 F5 11 Why aTraditional Firewall won’t Secure your Applications A WAF ENABLES PROTECTION AGAINST APPLICATION LAYER 7 ATTACKS Blocked by a NW Firewall Blocked by WAF Legitimate Traffic WEB APPLICATION FIREWALL vs. NETWORK FIREWALL
- 12. ©2022 F5 12 Strong Appand API Security Built for Modern Apps CI/CD Friendly NGINX App Protect WAF
- 13. ©2022 F5 13 Strong Appand API Security App and API security and controls built using F5 advanced WAF technology. Blocks attacks and helps prevent downtime. OWASP Top 10 Regulatory Compliance IP Blocking Prevent sensitive data loss F5-based Layer 7 Attack Protection API Security
- 14. ©2022 F5 14 Built forModern Apps High performance security, low latency and highly scalable. Seamless integration into the #1 web application platform High performance Deployment options Minimizes tool sprawl Lightweight footprint Seamless NGINX Integration 20X+ faster than alternative OSS
- 15. ©2022 F5 15 CI/CD Friendly Enablesecurity to keep pace with DevOps and Support “shift left” initiatives Declarative policies Speed Time to Market Enable AppDev Reduced cost Feedback loops Automate security in CI/CD cycle
- 16. ©2022 F5 16 NGINX AppProtect WAF Deployment Options 3
- 17. ©2022 F5 17 Fully IntegratedSolution • Configured from familiar, powerful K8s API • Integrates security and WAF natively into the CI/CD pipeline Business Benefits • Reduce complexity and tool sprawl • Accelerate time to market and reduces costs with DevSecOps-automated security • Achieve resilience, visibility and security Easily Secure your Kubernetes Apps and Services with NGINX App Protect WAF and NGINX Ingress Controller we are here SECURE YOUR KUBERNETES ENVIRONMENT AT SCALE
- 18. ©2022 F5 18 NGINX IngressController A SPECIALIZED LOAD BALANCER FOR KUBERNETES ENVIRONMENTS Kubernetes Node Kubernetes Node Kubernetes Node Ingress controllers Load balancer Users • Accepts traffic from outside the Kubernetes platform, and load-balances it to pods (containers) running inside the platform • Configured using the Kubernetes API, with objects called ‘Ingress Resources’ • Monitors the pods running in Kubernetes, and automatically updates the load balancing rules if, for example, pods are added or removed from a service
- 19. ©2022 F5 19 Choosing yourModel for App Protection SNI VS PATH-BASED
- 20. ©2022 F5 20 CONFIDENTIAL Host TLS Upstreams Routes - Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional Host TLS Upstreams Routes -Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional NGINX Ingress Resources – Rich Capabilities Host TLS Policies Upstreams Routes - Path Policies Action Split Match Route ErrorPage pass redirect return proxy delegation VirtualServer pass redirect return proxy pass redirect return proxy Host Upstreams Subroutes - Path Policies Action Split Match ErrorPage pass redirect return proxy VirtualServerRoute NGINX server configuration NGINX http configuration Server and HTTP snippets NGINX location configuration Location snippets Policies Access Control Rate Limiting Auth (JWT, OIDC) MTLS (Ingress/Egress) App Protect WAF
- 21. ©2022 F5 21 NGINX AppProtect WAF – Visibility Integrations
- 22.
- 23. ©2022 F5 23 A LIGHTWEIGHT,HIGH-PERFORMANCE MODERN APP SECURITY SOLUTION NGINX App Protect WAF Delivers Strong Kubernetes App Security Security policies and protections are optimized for DevOps workflow. Deploy and manage app security controls across distributed environments. Embed Security Policy Into Your Pipeline Integrate security controls directly into your pipeline with security as code. Secure Modern Apps Strong security controls for microservices, containers, APIs, and other modern topologies. Gain Security Insights Security tools that go beyond alerts with intelligent security insights about your apps and APIs. Centralized visibility and insights dig into the root cause of application issues.
- 24.
- 25. ©2022 F5 25 Test DriveNGINX for yourself with a 30-day FREE Trial Today! https://www.nginx.com/free-trial-request-nginx-ingress-controller/ If you would like to try today’s presented demo for yourself, you can access it from the GitHub Repo located here: https://github.com/rawdata123/app-protect-sni/tree/master