Posts under Container Security

Survey Says … Security Tops the List of Container Strategy Concerns

Survey Says … Security Tops the List of Container Strategy Concerns

This week StackRox launched the industry’s first ever State of Container Security report. To compile the findings, we surveyed more than 230 IT leaders across operations and security roles. Some responses came as no surprise – the dominance of Docker and Kubernetes, for example, or the breadth of industries using containers to accelerate application roll out. But many results did surprise us – including the extent to which security leads the list of concerns about companies’ container strategies.

Why We Chose StackRox - Guest Post and Video from Mux

Why We Chose StackRox - Guest Post and Video from Mux

Today we posted the news that we’ve adopted StackRox to secure our environment. I wanted to share a bit about our thought process and results in hopes of helping others like us. Security is difficult to manage at every level of technology development, from building a simple web app to running enormous platforms like the tech giants manage — recent tech headlines just prove this point. Like other early-stage SaaS startups, we here at Mux face the combined challenges of having limited resources, a relatively large technology footprint, and the obvious focus on building strong product features.

New and Improved! Our Updated Container Security Platform

New and Improved! Our Updated Container Security Platform

The StackRox Container Security Platform Today we announced that we will release an updated version of the StackRox Container Security Platform later this month. As we continue to lead the industry in container security innovation, we are excited to detail our new capabilities. Over the past nine months or so since we started shipping our software, we have seen a few consistent patterns among our enterprise customers. These organizations remain focused on reducing the attack surface across their container environments, and addressing orchestrator-based threats are a key part of that initiative.

Gartner on Delivering DevOps Risk-Prioritized Vulnerability Guidance

Gartner on Delivering DevOps Risk-Prioritized Vulnerability Guidance

We recently highlighted Gartner’s advice to “shift right” with security, to avoid burdening developers from a security standpoint. Gartner analyst Dale Gardner continued that theme with this opening slide to his talk advising teams to “Fix What Matters” in the area of vulnerabilities. Dale noted that we excel at finding vulnerabilities, leading to the garbage heap analogy. “We end up with this graveyard of multiple vulnerability reports,” Dale observed. Bringing this world view into container security doesn’t make this problem any easier – indeed, now you have more “things” to secure.

StackRox at BSidesSF 2018

StackRox at BSidesSF 2018

We’re gearing up (pun intended) for an exciting time next week in San Francisco, and we’re thrilled to kick it off on Sunday at BSidesSF at City View in the Metreon. We’re proud to sponsor and support this event – an amazing grassroots effort that unites the information security community to share knowledge. With this year’s steampunk theme, the conference promises to deliver inspirational talks, stimulating discussions, and of course, evenings filled with entertaining discourse and delectable libations.

Breaking Bad: Detecting real world container exploits

Breaking Bad: Detecting real world container exploits

There has never been a better time to be a DevOps engineer. Compared to traditional web stacks, containerization has dramatically streamlined the task of deploying web services such as databases, key/value stores, and servers. Furthermore, container orchestration tools, like Google’s Kubernetes and Docker Swarm, enable organizations to automate the deployment and management of these containerized applications. But the tools that make life easier and more efficient for engineers can also be a gift to an attacker.

Introducing StackRox Prevent: Reimagining Container Deployment Security to Minimize Your Attack Surface

Introducing StackRox Prevent: Reimagining Container Deployment Security to Minimize Your Attack Surface

Security leaders today are charged with the increasingly complex task of defending the technology that powers modern enterprises, at a time when the software stack has never been more diverse or unmanageable. Implementing a coherent security program can seem daunting in light of the patchwork of duties that may fall under a security organization’s purview: static code analysis, identity and access management, compliance, data privacy and integrity, vulnerability management, monitoring, incident response, threat hunting, forensics…and the list continues.

Frenemies No More: Containers Are Changing the Security-Business Relationship

Frenemies No More: Containers Are Changing the Security-Business Relationship

This is a guest blog by Rob Fry, an accomplished architect, inventor and public speaker with 20 years’ experience primarily in large-scale Internet companies and the utility industry. At Netflix he invented FIDO, a patented open source security orchestration platform, and while at Yahoo created the DUBS configuration and automation framework for production servers. Over the past two decades, we’ve seen adoption of new technologies reshaping the landscape of how we operate and secure our businesses.

Video demo of StackRox enterprise integrations

Video demo of StackRox enterprise integrations

In the eighth video in our demo series, we walk you through the third-party enabled integrations that StackRox provides, including integrations with identity providers, role-based access control (RBAC), Security Assertion Markup Language (SAML) providers, notification services like PagerDuty and Slack, and log management solutions.

Video demo of StackRox reports

Video demo of StackRox reports

In the seventh video in our demo series, we’ll take a look at StackRox reports. StackRox gives you summary reports for any period of time to help you get a sense of the risk in your environment. In this video, you can see how we provide a number of preset reports, including an overview summary, alerts by severity, top attacks, policy violations, infected applications and services, top vulnerable services and images, and external infection sources.

KubeCon 2017 Recap: Community, Service Meshes, and Security

KubeCon 2017 Recap: Community, Service Meshes, and Security

“Keep Cloud Native Weird.” That was the motto of KubeCon + CloudNativeCon 2017, which I had the opportunity to attend last week in Austin. With the conference attracting more than 4,100 participants, hundreds of technical sessions, new project announcements, and key updates on existing initiatives, it is clear that the cloud native computing revolution continues to accelerate. Here are some of the highlights I found most interesting. KubeCon welcome mural

Containers, security, and compliance in the financial sector: putting it all together

Containers, security, and compliance in the financial sector: putting it all together

Since day one at StackRox, three years ago, we’ve made it a point to meet regularly with CISOs from top banks and other global 2000 companies. The focus of these discussions was on how we might expedite the adoption of containers, and improve the process of maintaining better security and regulatory compliance. Over the course of these many conversations, I’ve found that there are some important ideas worth sharing broadly, though they’re likely most interesting to IT and security leaders in the financial world, where both competitive and regulatory pressures are very high.

Securing containers on any infrastructure with StackRox & Docker Enterprise Edition

Securing containers on any infrastructure with StackRox & Docker Enterprise Edition

Four and a half years since it was first introduced, Docker continues to have a profound impact on reshaping how developers build, ship, and run software applications. Few could have anticipated the speed of Docker adoption that we have observed to date with more than 21 million hosts now running Docker, over 24 billion Docker container downloads, and a vibrant ecosystem of 100,000+ third-party projects that incorporate Docker. As the de facto standard for the container runtime and image format, Docker has democratized the ability for anyone to take advantage of container technologies that could previously only be utilized by a handful of the world’s largest, cloud-native companies.

Fueling digital transformation in the public sector with OpenShift & container security

Fueling digital transformation in the public sector with OpenShift & container security

On November 9, 2017, I attended the 9th annualRed Hat Government Symposium in Washington, DC, and quickly got a sense of Red Hat’s momentum in the public sector and the rapid growth of OpenShift, Red Hat’s container application platform based on Kubernetes. Over 600 participants attended the symposium, many of whom were senior IT and cybersecurity leaders from government agencies such as Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), General Services Administration (GSA), Social Security Administration (SSA), U.

Pairing StackRox with Google Kubernetes Engine for runtime security

Pairing StackRox with Google Kubernetes Engine for runtime security

In the three and a half years since its release, Kubernetes has become one of the most popular container management systems on the market. A survey by 451 Research found that 71% of enterprise organizations running containers are using Kubernetes. Likewise, Google Kubernetes Engine (GKE) has emerged as one of the leading managed services for Kubernetes deployments, attracting customers like Niantic, Philips, Meetup, and Evernote. GKE extends the baseline benefits of Kubernetes, including automated cluster deployment, managed container networking, autoscaling, and a managed master node with guaranteed uptime and automated Kubernetes upgrades.

Policy management

Policy management

Here is our fifth video in our demo series of our StackRox platform. In this demo, see how you can manage policies for your highly distributed and/or container environments. You can use our preloaded policies, or create new policies, helping you use StackRox to automatically detect attacks, building better security hygiene into your infrastructure in development and production.