Docker container webinar final

2. © 2019 ControlCase All Rights Reserved Our Agenda 2 4 2 3 Your IT Compliance Partner – Go beyond the checklist ControlCase Introduction About Docker and Container Docker/ Container Compliance ControlCase Solution Why ControlCase5 1

4. © 2019 ControlCase All Rights Reserved ControlCase Snapshot 4 Certification and ContinuousCompliance Services Go beyond the auditor’s checklist to: Dramatically cut the time, cost and burden from becoming certified and maintaining IT compliance • Demonstrate compliance more efficiently and cost effectively (cost certainty) • Improve efficiencies • Do more with less resources and gain compliance peace of mind • Free up your internal resources to focus on their priorities • Offload much of the compliance burden to a trusted compliance partner 1000+ Clients 300+ Security Experts 10,000+ IT Security Certifications

5. © 2019 ControlCase All Rights Reserved Solution 5 Certification and Continuous Compliance Services Automation -DrivenSkyCAM Partnership Approach IT Certification Services Continuous Compliance Services “I’ve worked on both sides of auditing. I have not seen any other firm deliver the same product and service with the same value. No other firm provides that continuous improvement and the level of detail and responsiveness.” Security and Compliance Manager, Data Center

6. © 2019 ControlCase All Rights Reserved Certification Services 6 OneAudit – Collect Once, Certify Many PCI DSS ISO 27001 & 27002 SOC 1, SOC 2, SOC 3, & SOC for Cybersecurity HITRUST CSF HIPAA PCI P2PE GDPR NIST 800-53 PCI PIN PCI PA-DSS FedRAMP PCI 3DS “You have 27 seconds to make a first impression. And after our initial meeting, it became clear that they were more interested in helping our business and building a relationship, not just getting the business.” Sr. Director, Information Risk & Compliance, Large Merchant Automation- DrivenSkyCAM Partnership Approach IT Certification Services Continuous Compliance Services

8. © 2019 ControlCase All Rights Reserved What is Container 8 Containerization refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances. Popular Containerization Solutions: 1. AWS ECS 2. Google Kubernetes 3. Open Source Docker Technology

9. © 2019 ControlCase All Rights Reserved Docker and AWS ECS 9 Docker is an open platform for containerization and can be used to deploy containers for developers and sysadmins Amazon ECS is a highly scalable, high-performance container orchestration service to run Docker containers on the AWS cloud. Google Kubernetes Engine (GKE) is a managed production ready environment for deploying containerized applications

10. © 2019 ControlCase All Rights Reserved Recap of Terminology 1. Containerization is a “feature” 2. Docker is an “open source software” that enables the containerization feature 3. ECS is “Amazon’s implementation” of the containerization feature 4. GKE is “Google’s implementation” of the containerization feature 10

13. © 2019 ControlCase All Rights Reserved Compliance from Container Context 13 Physical Client Hosted Datacenter Managed Service Cloud Client Hosted Service Cloud Container Service Providers Hardware Client Responsibility Provider Responsibility Provider Responsibility Provider Responsibility OS Layer Client Responsibility Client Responsibility Client Responsibility Provider Responsibility Container Layer Client Responsibility Client Responsibility Client Responsibility Client Responsibility Application Layer Client Responsibility Client Responsibility Client Responsibility Client Responsibility Compliance Responsibility Matrix in case of Different Container Hosting Models

14. © 2019 ControlCase All Rights Reserved Compliance Responsibility Matrix using Amazon/Google Clouds 14 Compliance Area Responsibility Scoping Customer Network Shared Configuration Management Customer Data Encryption at rest Customer Data Encryption in transit Customer Anti-Malware Customer Application Security Customer Logical Access Customer Physical Security AWS Logging and Monitoring Customer Security Testing Customer Policies and Procedures, Risk Assessment, Third Party Management, Governance and Compliance and Incident Response Customer

15. © 2019 ControlCase All Rights Reserved Top 10 Best Practices for Compliance 15 Number Technology Difference Compliance Best Practice 1 Traditional development practices, patching techniques, and system upgrade processes may not apply to a containerized environment Ensure developers are trained in secure practices to develop, run, test and support applications using container technologies 2 When using a container-specific host OS, attack surfaces are typically much smaller than they would be with a general-purpose host OS, so there are fewer opportunities to attack and compromise a container-specific host OS. Whenever possible, you should use container-specific host OSs to reduce their risk. At the same time it is important to note that container-specific host OSs will still have vulnerabilities over time that require remediation. 3 Segmenting containers by purpose, sensitivity, and threat posture provides additional defense in depth. Group containers in this manner and you will make it more difficult for an attacker who compromises one of the groups to expand that compromise to other groups. 4 Weak orchestrator configurations can increase risk due to - Unauthorized hosts joining the cluster - Single point of failure - Unencrypted inter process communications Harden orchestrator configurations 5 Traditional tools are often unable to detect vulnerabilities within containers, leading to a false sense of safety Adopt tools and processes to validate and enforce compliance with secure configuration best practices for images. This should include having centralized reporting and monitoring of the compliance state of each image, and preventing non-compliant images from being run.

16. © 2019 ControlCase All Rights Reserved Top 10 Best Practices for Compliance 16 Numbe r Technology Difference Compliance Best Practice 6 Network and monitoring tools are not necessarily all container aware. Container-aware network monitoring and filtering would detect anomalous connections to other containers during the attempt to map other systems. 7 Process and file system activity is more interrelated than traditional segmented environments. The usage of mandatory access control capabilities can provide additional barriers to ensure that process and file system activity is still segmented within the defined boundaries. 8 Segmentation of workloads ensures that the scope of the compromise would be limited to apps of a common sensitivity level that are sharing the host. For example, a compromised runtime on a host only running web apps would not impact runtimes on other hosts running containers for financial apps. Segment workloads by type of applications and sensitivity of data 9 Traditional tools for software management (including management of images) do not necessarily work in a containerized environment. Ensuring software is implemented that allows only vetted, tested, validated, and digitally signed images are allowed to be uploaded to an organization’s registries. 10 Traditional environment segregation techniques may not work. You should institute separate environments for development, test, production, and other scenarios, each with specific controls to provide role-based access control for container deployment and management activities.

17. © 2019 ControlCase All Rights Reserved Top 10 Best Practices for Compliance Summary Container Compliance - Best Practices 1. Make developers aware to support the new way of developing, running, and supporting applications made possible by containers. 2. Use container-specific host OSs 3. Group containers with the same purpose, sensitivity, and threat posture on a single host OS 4. Harden Orchestrator configurations 5. Use container-specific vulnerability management tools 6. Implementing container-aware network, process monitoring and filtering and Malware filtering 7. Use of mandatory access control 8. Segmentation of workloads 9. Only vetted, tested, validated, and digitally signed images upload and run 10. Separate environments for development, test, production, and other scenarios 17

19. © 2019 ControlCase All Rights Reserved Achieving Compliance in Cloud 19 Compliance Area Responsibility ControlCase Solutions Scoping Customer Network Shared Vulnerability Scanning Configuration Management Customer Config Scanning Data Encryption at rest Customer Data Encryption in transit Customer Anti-Malware Customer Application Security Customer Application Scanning Logical Access Customer Physical Security AWS Logging and Monitoring Customer Security Testing Customer Pen Testing Policies and Procedures, Risk Assessment, Third Party Management, Governance and Compliance Customer Policy Manager

21. © 2019 ControlCase All Rights Reserved Automation-driven 21 SkyCAM IT Compliance Portal Automation-driven certification and continuous compliance SkyCAM IT Compliance Portal • Cut evidence collection time up to 70% • In the cloud or on-prem • Go beyond monitoring and alerting to predict, prioritize and remediate compliance risks before they become security threats Automated Evidence Collection Real-time Certification Dashboard Predictive Continuous Compliance (AI-powered) • Stay on top of progress with visibility into your certification process with drill down capability GRC Platform Integration • Integrate and extend capability of GRC platforms Automation- DrivenSkyCAM Partnership Approach IT Certification Services Continuous Compliance Services

23. © 2019 ControlCase All Rights Reserved ControlCase Certification Outcomes 23 “It’s a challenge keeping up with the changing compliance landscape. Given that we had GDPR and now the California data privacy law, not to mention HIPAA and others, there are a lot of regulations and frameworks to keep up with and a lot of time spent preparing for audits. That puts a lot of overhead and strain on me and my team. We don’t just don’t have the expertise or time to keep up. Before ControlCase “We cut audit prep time by 70% using ConrolCase. It was their partner approach to us; a combination of their expertise, their responsiveness and automation. They brought us great ideas on how to streamline our process, and we were able to take advantage of automated data collection. And, their IT Compliance Portal gave us visibility throughout the entire process. Another thing - We don’t look at compliance as a once a year event, and now, with ControlCase’s Continuous Compliance services, we have the visibility into what’s in compliance and what’s not all year long. We can quickly remediate an issue before it becomes a security threat.” With ControlCase Cut audit prep time by 70%

24. © 2019 ControlCase All Rights Reserved Summary – Why ControlCase 24 “They provide excellent service, expertise and technology. And, the visibility into my compliance throughout the year and during the audit process provide a lot of value to us.” Dir. of Compliance, SaaS company Your IT Compliance Partner – Go beyond the auditor’s checklist Partnership Approach SkyCAM IT Compliance Portal Automation driven Continuous Compliance Services

25. © 2019 ControlCase All Rights Reserved Email contact@controlcase.com Telephone Americas +1.703-483-6383 India: +91.22.50323006 Social Media Conection Suport www.facebook.com/user www.linkin.com/user Visit our website www.controlcase.com THANK YOU FOR THE OPPORTUNITY TO CONTRIBUTE TO YOUR IT COMPLIANCE PROGRAM

Docker container webinar final

Docker container webinar final

Recommandé

Contenu connexe

Tendances

Tendances(20)

Similaire à Docker container webinar final

Similaire à Docker container webinar final(20)

Plus de ControlCase

Plus de ControlCase(14)

Dernier

Dernier(20)

Docker container webinar final

Notes de l'éditeur