This is a talk Jianing Guo and I gave at Google Cloud Next 2018 about securing software supply chains with Binary Authorization. I showed off the tool my team developed called Voucher which we later donated to the Grafeas organization.
Containers have revolutionized how we develop, package, and deploy applications. As enterprises create more containerized workloads, the security of the software supply chain must be top of mind. Join this session to learn how security teams can enhance deploy-security security. We’ll also hear from the security team at Shopify to learn how they use GCP tools as part of their container security strategy and best practices.
Shopify has leveraged Kubernetes through Google Container Engine (GKE) to build its new cloud platform. This PaaS is currently serving the majority of the company’s internal tools as well as business-critical production workloads. Moving to Kubernetes and a public cloud is no easy task, especially for a security team.
Given industry’s limited experience with cloud computing and cloud native technologies, this talk hopes to demystify some of these core cloud concepts. We’ll talk about containers: what they are, how to build them, how to secure them, and how to integrate security tooling into build and deployment pipelines.
Building a secure container is one thing, but how do we deploy containers to production? What does this mean? We’ll introduce Kubernetes, an open-source system for automating deployment, scaling, and management of containerized applications. With Kubernetes we also have a number of security controls that we can implement to further restrict the operation of containers. We’ll explore some of these primitives as they’ll fit nicely with the context on container security.
Lastly, running on a public cloud comes with its own unique challenges. We’ll explore some of the pitfalls we’ve encountered deploying infrastructure to a public cloud.