The tech industry press has been abuzz this week with news of the first major security hole discovered in Kubernetes, with coverage in ZDNet, The Stack, and TechTarget’s Search IT Operations. Given the prevalence of Kubernetes in organizations’ tech stacks and the fact that it’s the first discovered security flaw, the news is pretty big. Here at StackRox, we were surprised in a couple ways – first, with its scope, and second, that it wasn’t discovered earlier.
This week StackRox launched the industry’s first ever State of Container Security report. To compile the findings, we surveyed more than 230 IT leaders across operations and security roles. Some responses came as no surprise – the dominance of Docker and Kubernetes, for example, or the breadth of industries using containers to accelerate application roll out. But many results did surprise us – including the extent to which security leads the list of concerns about companies’ container strategies.
Today we posted the news that we’ve adopted StackRox to secure our environment. I wanted to share a bit about our thought process and results in hopes of helping others like us. Security is difficult to manage at every level of technology development, from building a simple web app to running enormous platforms like the tech giants manage — recent tech headlines just prove this point. Like other early-stage SaaS startups, we here at Mux face the combined challenges of having limited resources, a relatively large technology footprint, and the obvious focus on building strong product features.
I am thrilled to share the news that after taking a year-long sabbatical, I have joined the team here at StackRox! I enjoyed nearly five years at Skyhigh Networks, running products and marketing and having a great time with the team. We were acquired by McAfee this past January, and I took this year to really dig in on what I wanted to do next. I want to send a huge shout out to all the investors, technologists, executives, and security professionals who took time out of their busy schedules to meet with me this year to share valuable insights and learnings.
We’re excited to share the news today that we’ve entered into a technology development and strategic investment agreement with In-Q-Tel (IQT). For nearly 20 years, IQT has been critical to driving cutting-edge technology into the U.S. Intelligence Community. The not-for-profit investor identifies innovative security startups and connects them with U.S. government agencies chartered with keeping the United States safe. In choosing to partner with StackRox, IQT has signaled the criticality of containers in driving application innovation today and the advanced security StackRox provides for these environments.
We were pleased to present at Google Cloud Next 2018 at the request of Allan Naim, a Kubernetes Engine product manager at Google. In our talk, we highlighted reference architectures for container security and technical demos of attack vectors in the ecosystem. Our talk centered around architectures for FinTech companies running on Google Kubernetes Engine (GKE), but anyone running containers and Kubernetes can leverage the findings we’ll review here.
We’re picking up our coverage of Gartner’s security conference with a continued discussion of the Top 10 Security Projects Gartner recommends you do this year, in prioritized order. In Part I of the discussion, we highlighted Privileged Account Management, CARTA-inspired Vulnerability Management, and Active Anti Phishing. Neil continued his list by highlighting the need for protections like StackRox provides. #4 – Application Control on Server Workloads For this project, Neil emphasized the need to reduce the attack surface and limit certain functions from running on servers.
We’ve been highlighting a number of the talks at Gartner’s security conference last month, including on the value of shifting right with security, risk-prioritized vulnerability guidance, and the principles of continuous security. In this recap, we’ll profile Neil MacDonald’s presentation on the Top 10 Security Projects you should undertake this year. He led off the talk acknowledging we’re never “done” in security, and that it’s futile to try to build perfect security.
We’ve enjoyed a great partnership with Google, with our StackRox Container Security Platform enhancing the security capabilities of Google Cloud Platform. We were honored when the folks at GCP asked us to speak at the Next conference on security reference architectures. During his talk on Wednesday, July 25, our head of products, Wei Lien Dang, will highlight three customers – a Fortune 100 bank, a Fortune 50 financial services firm, and a Global 200 e-commerce company.
The StackRox Container Security Platform Today we announced that we will release an updated version of the StackRox Container Security Platform later this month. As we continue to lead the industry in container security innovation, we are excited to detail our new capabilities. Over the past nine months or so since we started shipping our software, we have seen a few consistent patterns among our enterprise customers. These organizations remain focused on reducing the attack surface across their container environments, and addressing orchestrator-based threats are a key part of that initiative.
In recent blog posts, we’ve been highlighting some of the key takeaways from Gartner’s recent security conference. In the session on the top 10 principles of CARTA (Continuous Adaptive Risk and Trust Assessment), Neil MacDonald highlighted how organizations need to change their security practices to match today’s world. One of the more interesting observations Neil made was that organizations in general have over-invested in preventative measures and they’ve underinvested in the detection and response.