Container Security Using Microsoft Defender
0 likes260 views
Microsoft Defender for Containers provides security for container workloads running on Kubernetes. It monitors clusters for misconfigurations and vulnerabilities, provides runtime threat detection, and generates alerts. It works across multiple clouds by deploying agents and daemons to collect security signals from the API server, nodes, and images. A demonstration showed Microsoft Defender in action monitoring container workloads.
![Environment Hardening
9
โ Continuous monitoring of your Kubernetes clusters
โ Wherever they're hosted [AWS - EKS, Azure - AKS, GCP - GKE, On-Premise (using
ARC)]
โ Continuously assess clusters to provide visibility of misconfigurations
โ Provide Guidelines to mitigate the issues
โ Kubernetes data plane hardening
โ Azure Policy add on
โ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and
safeguards on clusters in a centralized, consistent manner.
โ Defender Daemonset
โ Deployed to each worker node, collects security-related data and sends it to
Defender for analysis. Required for runtime protections and security
capabilities](https://image.slidesharecdn.com/container-security-using-msft-defender-230320050142-e998ab46/85/Container-Security-Using-Microsoft-Defender-9-320.jpg)
![How it works
14
โ Defender for Containers receives and analyzes:
โ Audit logs and security events from the API server
โ Cluster configuration information from the control plane
โ Workload configuration from Azure Policy
โ Security signals and events from the node level
โ Components deployed
โ Azure Policy add on
โ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and
safeguards on clusters in a centralized, consistent manner. [azure-policy,
azure-policy-webhook]
โ Defender Profile Daemonset
โ Deployed to each node provides the runtime protections and collects signals
from nodes using eBPF technology. [Microsoft-defender-collector-ds,
microsoft-defender-publisher-ds, microsoft-defender-collector-misc]](https://image.slidesharecdn.com/container-security-using-msft-defender-230320050142-e998ab46/85/Container-Security-Using-Microsoft-Defender-14-320.jpg)
![[Azure Governance] Lesson 4 : Azure Policy](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson4-azurepolicy-190519183014-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
What's hot (20)
Similar to Container Security Using Microsoft Defender (20)
![[WSO2Con USA 2018] Architecting for Container-native Environments](https://cdn.slidesharecdn.com/ss_thumbnails/wso2con2018-architectingforcontainernativeenvironments-180723072902-thumbnail.jpg?width=560&fit=bounds)
![c0c0n Elastic Security Workshop - 7.7 [Elastic SIEM].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/c0c0nelasticsecurityworkshop-7-240724022125-1e952d18-thumbnail.jpg?width=560&fit=bounds)
Ad
Recently uploaded (20)
Ad
Container Security Using Microsoft Defender
- 1. Container Security with Microsoft Defender Rahul Khengare 18th Mar 2023 DevOps-Pune Meetup Group
- 2. About Me Sr. Sta๏ฌ Engineer, Zscaler โ Cloud Security/DevOps/DevSecOps/SRE โ Blogger (oss-world, thesecuremonk) โ Co-Organizer โ DevOps-Pune, DevSecOps-Pune โ Open Source Software and CIS Contributor โ Past Organization: Cloudneeti, Motifworks, NTT Data โ https://www.linkedin.com/in/rahulkhengare
- 3. Agenda โ Need for Container Security โ Overview of Microsoft Defender for Cloud โ Microsoft Defender Capabilities โ How it works โ Demo
- 4. How you are securing the container workloads?
- 5. Known Practices โ Use of private registry and trusted images โ Continuous Vulnerability scanning of images (Trivy, Encore) โ Limit container privileges โ Use of network segmentation โ Implement least privilege access (RBAC) โ Logging and Monitoring โ Implement runtime security for threat detection โ Preventive and detective policies - Kyverno โ Security and Compliance Audits โ Certificates, securing endpoints โ Many More โฆ
- 6. โ 93% experienced at least one security incident in their Kubernetes environments in the last 12 months - State of Kubernetes security report * Kubernetes adoption, security, and market trends report 2022
- 7. Microsoft Defender What it is? Capabilities? How it works?
- 8. Overview of Microsoft Defender for container โ Cloud Native solution to โ Improve โ Monitor โ Maintain the security of your clusters, containers, and their applications. โ Multi-cloud Supports K8s o๏ฌering and registries from di๏ฌerent CSP like EKS, GKE, ECR โ Kubernetes Native Deployment at Scale โ Provides Security Alerts and Remediation Capabilities RUN TIME Threat Detection ENVIRONMENT HARDENING Cluster Configurations Vulnerability Container Image Container Security
- 9. Environment Hardening 9 โ Continuous monitoring of your Kubernetes clusters โ Wherever they're hosted [AWS - EKS, Azure - AKS, GCP - GKE, On-Premise (using ARC)] โ Continuously assess clusters to provide visibility of misconfigurations โ Provide Guidelines to mitigate the issues โ Kubernetes data plane hardening โ Azure Policy add on โ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and safeguards on clusters in a centralized, consistent manner. โ Defender Daemonset โ Deployed to each worker node, collects security-related data and sends it to Defender for analysis. Required for runtime protections and security capabilities
- 11. Vulnerability Assessment 11 โ Supports Azure ACR and AWS ECR โ Triggers โ On push โ Recently pulled โ On import โ Continuous scan based on an image pull and for running images โ View and remediate findings โ Disable specific findings like severity below medium, non patchable findings
- 12. Runtime Threat Protection 12 โ Provides real-time threat protection โ Generates alerts for suspicious activities โ Threat protection at the cluster level โ Provided by the Defender agent and analysis of the Kubernetes audit logs. โ Threat protection at Host level โ Monitors the attack surface of multi cloud Kubernetes deployments based on MITRE ATT&CKยฎ matrix for Containers โ Examples: โ Exposed Kubernetes dashboards, High-privileged roles, Sensitive mounts โ Anomalous secret access, Detected suspicious file download, Possible backdoor detected
- 13. Runtime Protection - Alerts 13
- 14. How it works 14 โ Defender for Containers receives and analyzes: โ Audit logs and security events from the API server โ Cluster configuration information from the control plane โ Workload configuration from Azure Policy โ Security signals and events from the node level โ Components deployed โ Azure Policy add on โ Extends Gatekeeper v3, required to apply at-scale auditing, enforcements and safeguards on clusters in a centralized, consistent manner. [azure-policy, azure-policy-webhook] โ Defender Profile Daemonset โ Deployed to each node provides the runtime protections and collects signals from nodes using eBPF technology. [Microsoft-defender-collector-ds, microsoft-defender-publisher-ds, microsoft-defender-collector-misc]
- 15. How it works for AKS 15
- 16. How it works for EKS 16
- 17. How it works for GKE 17
- 20. References โ Microsoft Defender for container โ Runtime alerts for Kubernetes cluster โ Azure provided container recommendations โ Vulnerable K8s for testing โ Azure Policies for K8s