Hello everyone Good morning First
session of the day Welcome in the next
60 minutes I'm going to talk about a
heavy Talk topic at this Early Morning
The Best For securing Your asher
container service but Before we start a
Bid about me
My name is Sjoukje zaal I'm the head of
the Microsoft Cloud serie for Captain
the Netherlands en besluiten maar
Microsoft regional director And The Edge
en aimp So if you want to contact me
after Works My Twitter handles on the
screen and if you are very intersted you
can also Take A Look At My Block
So What is the agenda for this session
we go to kick off with What containers
are I know most of you most of you
already know what they are but we need
to do a bit of an introduction and Why
is With Us them
going to take a look at how you can
Secure container registry and your
images in it and I've demo About That a
Script how you can The Toy that democun
to take a look at aks en policies en hij
is some demo's Around That is well
Them Going To Look at monitoring very
important for security scenario's so we
going to Touch upon that refluens well
and laughely we going to look at
Microsoft Defender for cloud and what
this has to offer to securi your
container Services in Asia
so Let's Get Started What are Containers
It Is A lightweight stand alone
executiable
solution that you Run on a container
Platform aduzes an image Which is also
very
lightweight Everything that you need to
actually Run your application So It
includes the application itself al die
configuration files your system
libraries and more
They are aften compared to Virtual
machines because Both of them allow you
to package
Together with all the libraries en al
die other dependence
and provining isolated nivironments but
There are someone differences en Those
are containers are much More lightweight
theftual machines They Virtual Life Is
The Os level While vm's Virtual Life at
the hardware level and lasty
oscarnal and use Only af fraction of The
Memory that vm's require
So What does Microsoft has to offer from
a container perspective
first we have the container registry a
private you can Store All you images
Security
then we have asher container instanties
fully Manus service en alpha's The Fast
And simplest way to Run a containery
nation Without having to manages Any
infrastructure or Any Higher level
service you can Run Windows and Linux
Containers in it and you can also use it
as a Back Bone For Your ATS cluster
full container orchestration incluing
Services Discovery
automatic skeling comordanated
application upgrade if you have These
requirements than APS is your Solution
it all so offers integration with Azure
Active directory en It Off was net
working en monitoring paper buildies
that will we will diving later
They are a cup of More service that I'm
not going to use
in this session But I do want to brief
The Name Them You also have Web App for
containers en This Is basically For
scenarious where you are already using
abservices for instant or you have
single container depointments Dennis
very easy to Run your docker images on
web app for containers also fully
managed alfres oude oude matics geling
the same eh de Same caperbilities as all
your web apps in abservices and API is
That Run Inside Of The servers and lasty
you have asher container apps general
available now and this is also a fully
manage Platform but it Runs arm is build
On Top of Lot of powerful open source
teknologies in the cubanities Eco system
So It All so has support for keda for
instants We're not going to Focus on
this in the session But I do one two
Point Without for a bit
So What are then The Security concerns
in relation to containers you have
cornel explodes
In The cold Which Execute code with root
privileges en I like in the cornel is
shared amanda's containers and on the
host en this really ables in een extra
van Ability
jurasso heeft The Nile service attacks
because They share Those kernel
Resources It is very easy to have when
you have Access to 1 container to really
Star fout al die other containers as
well on your host and this can dan
result
is unable to access your application Or
Die Hole or entire system
you have container Breakout
Access to 1 container it Should not the
evil To Have To All The Other Containers
very important Poison images How do you
know that You're image is coming from
where it claims to be en How Do You Know
It's actually Safe And not tempered wit
hout
images
boven the host en all of your day day is
that wisk
and Leslie compromise Secrets also very
important
Every container needs to do a request to
a Different service Maybe A Day The Base
Maybe other types of Services And For
Those
voor doos to access Those Services Ik
wil niet Sam's Sword of Us name password
or Key or Secret so it's very important
to store Those Keys security
and not put Them in plane Tex code for
instants so One Of The Solutions that
you can use for this in asher is of
course The asher keyfault Which We are
also going to use in the demo
So What does Azure container regges to
has to offer like already Mansions It Is
A manage private docker registret
service beest dan de two Point al reggae
en It Office Different schools you have
Basic Standard and Premium en All Of The
schools have
a connection or has registreal
ventication with Azure Active directory
so That's supported for All The
Different scooters wat voor de premium
if you have really Advance replication
en kantrainer image distribution
scenarious de premium school also Office
Dio replication For Your images
voor security en Access you can login to
the registry user using The CI
order Standard Doctor login command en
die al die images are transfer over
https en It support tls to securior
client connections
en voor security and Access It also
offers are Back control and of course
Active directory
So What are then The security
recommendations zijn best practices for
your images in the air
always use a private registry like acr
No you want to know why Those images are
coming from and also monitor and scan
your images and Their lot so features
Inside Of asher out of the box that you
can use for this and last nu protect
These credentials use SR Key volt orsa
Mother service but Always protect this
redemptials
zo let's take a look at how you can
Deploy container registry
oké
so First I have created see Alive Script
that you can use
so First in discript her I go to set a
couple of variables
Like A Research Group name and acr name
a keyboard so going to Deploy keyfault
and a service principle name so We are
all so going to register een asherady
application en Give that application de
permission to push and pool images so
First you creator resource Group and we
do that Here In This Line of code And
then we are going to create are acr or
Ashe container registry and in this case
I'm using The Basics school and I'm also
putting into this Line of code admin
unable this True when you enable this
There Will Be A username and password
generated that you can up Tame in code
but also from the s reportal that you
can also used to access that containers
Security
then we going to Create a kievald
sorry
large yes
of course
keyboard And The Next Step is that we're
going to create that service principle
The Edge station and we're going to at
the permissions in this case
The Roll of acr push So This
azerwtustration Or application is Abel
to Pull and push images to the radistry
zo Next we're going to store These
values into keyboard The username and
the password
And then we going to do it the official
Way we going to connect to the keyfall
Again retrieve These value from the
keyboard
here you can see that We Are connecting
to that keyboard retrieving These to
values Again we going to login to Our
acr service
using These
credentials And then we going to
download or clone A Simple Basic asb dat
net application from my Get Up we Push
It
to alright
to connect again to that HCR environment
and retrieve that image Again with the
kardemptials of that asherad
e-registration And then The plooi a
container on asher container instasus
zo That's It I will sheridy Script some
My get help after work's well So if you
want to use Them for your own Solutions
you can Download them there
Oké Next
we have an asher container instants We
used credentials and easy rady
registration for it so we really have a
secured invitament now to Run Our single
containers but There is also asher
cubanity service that you can also use
and this has lots More a lot More
functionalities en from a networking
perspective in offers eh Basic
networking and this Type Of networking
is created when you Deploy The equis
invit Zo dat is de Basic configuration
Cube networking but There Is All so More
Advanced Network networking Which is
gold Escher containing container
networking Interface zo cni networking
en This is basically ehm in dissenario
ubesity connect your equis cluster to
already existing Network Inside Of Your
Azure uh invitament en al die
configurations So if you have security
requirements or security implementacions
bijstand en Network level en you want to
also enable That For Your atscaster than
you need to use Advanced networking when
you deed Boy It
's for it entity and Access management
It also offers die eh integration with
ehm asheradi
en With or Back with Roll based ex
control So you can Just configurate a
managed accordingly like All The Other
Services that you have Inside Of Us
integrated login en monitoring Cape
buildies
So you can really learn and understand
How that APS clusters behaving And how
your applications That are Detroit On
Top Of It Up forming
It is al ehm ehm het is al eh displayed
Inside Of asher monitor your container
Health is this Plate There and also eh
metrics For Your memory en processor
Power also There and all Swords of
information For Your notes en your
Containers
I will show you that ladybug
So What are then The
recommendations for ATS
network segmentations on Running
Containers
you don't want to you want to protect
Containers in one second from securities
in your other segments of your Cube
invitment of course and forced least
privileges in Run Time To Be anus This
Is A basic security best practice en dit
is also ehm applies to containers zo
insure that your containers are Running
with the least Possible privileges
and Leslie remove I Needed privilegious
as well also basic security best
practice
minimisted potential Attack service For
Your Containers
en On Top of That We also have building
policies Un Top Of Your EPS eh cluster
that you can use you can also create
your custom policies but the asher
policy Services is also available voor
your ECS cluster and What Does that has
to offer you can Create a Sign a manage
policies
en doos policies in Force Rules and
Effects On Top Of Your asher Resources
en in this case your a k s clauster en
in the value all your Resources
in in minutes and
kanstantly and you can assign Those
policies to Different levels in your
arsher invironment you can a Science
Them To The management Group level to
the subscription level en to the
resource Club level so there a multiple
levels that you can be Play this
Containers
There are Number of a facts That are
support It For Your policies The First
One is the artist Wanna Do Anything It
will always scan your invironment will
generate warning Event in your Locks
with you can dan Use To ehm two manager
invitament
but there a More There is also attent
policies dus So This policy is Really
Going to add Something to your
comfingration
en You Need A Man insidedentity for this
to set this up Because you need
permissions to actually add Something to
your informant die Play is not exist It
will add Something if it really doesn't
exist or If People Manual remove some
sort of configuration then this policyal
insure that it will be back to normal in
surinamount of time Oh dat heeft not
exist
Only It will always generated warning if
a certon Resources not available you can
disable Them So you can Keep Them
deploid Inside Of Your invitament but
configur Them To Be disabled
modifierinvironment and really a deny
effect Dit is not allowed to Deploy or
sorten service or to make surte And
configurations To Your Service
There two Different types of policies
of polises you have that single policy
Which has a definition I will show you
that later One and the definition is
going to be Inside to a Different level
and you Haven
is More Of A collection where you can
put multiple policy uh definitions in So
if you want to have multiple policies on
top of a single service oran top of a
single resource Group subscriptionar
management Group you can put them all in
the collection and this will Make sure
that each of the policies will be ehm eh
enabled eh When You Do Something Inside
Of Your invironment
So What is then The Actual Flow of that
policy What happens when you create one
you start with that definition you
create your own definition or you so
building definition from the air Portal
than you assign that definition to a
sortens Go management Group resource
Group or subscription And then The
Police service will Kickin en will do
some evaluation on your invironment
And then The outcumblebee It is ieder
compliance or none compliance And then
The user can do a check Inside Of The
Air portal see what the outcome was en
in case that it was nun compliance for
instants you can Create a remediation
task from the portal and Dandy asher
policy will policy service will make the
necessary changes Inside Of Your
invitament
So What are then The Police Depeche
It is best to start with First start
with Another
effective
Maybe Somewhere In Your environment a
Services deployed And then your hole
Production devirement Start to
fail so start with that all the effect
seawatt zouden Fit and when
everything is akkoording to your
requirements and the plan you can als
Always Change that effect
also consider die organisational
hirecase
you can Deploy a definition Anne
management Group level en in this case
you will Make sure that the definition
is available in all your Resources That
are under Death management Group and the
next you can esc Sign that definition to
a Different Scope Maybe to a resource
Group or Maybe to Just A single
subscription
Dit is best to create Anisha diff
definition So It is basically easier to
add extra policy stuiter One or remove
policies but if you really are value
validating intervisual policies Don't
incloud damn In The National de viet
because everytime you were You Waiting
that policy It will kicks say a kicks of
the whole collection en you need to wait
for Surgeon a Mountain
so let's take a look at How to Deploy
and a k s eh with admin azerad enabled
en dan Look At The Police that you can
depoil On Top Of It
zo Let's open discript
zo
satis
Group name and I music container
registreat we created in the previous
demo
so First I create and Group Inside Of
asgeraty voor de administrators zo
That's The First step
after Creation you will receive a Group
ID
copy that Because You Need That later op
de
Creators going to land
And then we going to create that aks
clusterat en die administrator Group
edit So You create that Group enable
And that admin Group with that ID
Do It en also you need to specific
in Here
So This is how you createn
ID of custer
I go to create Another Group Which is
forar Developers in this case who have
Different permission some top of that
so we Create a new Group Inside Of
asherad
copy that ID into a paramedar And then
we going to use airbag to add that Group
to Our aks question
en de First Time that I created this
session and this demo it was not that
easy to enable Acer rady you really Need
it to use the building cubanities
permissions eh for that And that really
Change In The Last Here so it's very
Easy now to enable and integrated with a
sheraty Just One single Line of code en
in this case we're going to add that
Group and we Give It the Roll of the
asher cubanity service cluster user roll
It's that Easy
And then we go to enable container
Inside On Top of this as well for a
monitoring tools This is free to use but
you need to enable It Duran Creation or
after
in the portal or using align of code in
powershell cialis Well
then
we going to retrief some credentials de
Sign into that cluster
we Create a yamul file voor deploying
die container image dat is already Store
in haar
acr invironment hear you see that we use
this images image This is the one week
created The previous step And then we
Simply applied at Yam of file to Our aks
custer en we have a application Running
with two on two Different notes
ehm
completely integrated with azurated
Zoë Vera move On To The Edge portal and
we see the deploid service there
I have the right Resort Group
Here is haar cluster
in the settings in the level menu you
can hear click on Police you can also Go
To The Police service in de Topman you
but you can directly go to the police
Here's Well
and here you can see the police service
en je ziet some passes that I have
already have created and Let's copy
because I'm going to use a building
policy
het scapie dus
easier to search
so firsty created definition in arcase
we going to USA building policy so we
can Pick a definition that is already
created for us
[Muziek]
I building policy That are cubanity
cluster should not allow privileges
privileges containers so we going to use
that Palace we openen open It Up here
you can see the definition file en die
effect in this case this policy uses
eighty deny effect
en Hear You can also Easily assign this
policy to your environment
he uselected Scope in arcase we going to
scopit
to a specific resource Group
because That's the only cluster that we
want to a Side in Police to selected And
then Make sure that The Police in
forcement is enabled in discase en klik
review create and create and now the
police edit on top of a subscription or
are resource Group en die policy server
service wil start die evaluation And
that Will Take some time Before that is
actually finished
zo'n Let's Go Back for a bit
en I already head some
already head The Police deployed On Top
Of It Twice
now and here you can see that in my case
this policy is actually complete
completely complian so I don't have to
do Any remediation On Top of that But I
do want to show you how you can do this
remediations so Let's Go Back
en klik al remediation Here
So It Will Take some time Before The
Resources are evoluated but after Words
policies that do not remediation
artisplay here Solid Just open 1 of die
af die policies in Disguise
Defender for Cloud is also
deploying some Police On Top of that and
Hear You can see that it provace you
with a subscription but it also provideo
with an Easy way to remediate your
Services so click remediate Here and
dance The Police service wil
automatically Make sure that your
Resources are compliance
zo That's It voor equis en voor policies
let's take a look at the
monitoringbilities
There are Different Services in asher
that you can use for monitoring en
forlogging your
day
application Insights that is basically
used by Aldi application that you Deploy
So if you have applications Running
Inside containers you can use
application Inside to lock that
On Top of That We have lock Analytics
and this Services is used by all your
She Resources so a CIA acr asger Key
Vault en ATS are all using log Analytics
live applications
and It Doesn't Matter Where You host
Desert vacations you can House Them in a
Different Cloud on your promisesystem
in a Hybrid Cloud If You just use del
libraries for application Inside you can
use all you can use Them in all Swords
of applications en also in applications
that I build with multiple languages in
Different languages dat net no JS Java
dl have support for epication Insights
en de laatste you can integrated with
your Devil apps process and It has lots
of connection Points to Different
development tools complete building CS
code Visual Studio so very easy to use
logins
that is really you Create a lock
Analytics work Space for your Different
Resources for incentive is a best
practice to create One work Space for
your devinvironment 1 for Production on
for acceptance To Make sure that These
that this data is sacrogated from each
other
It is complete integrate with asher
monitor if you want to create your own
top of that you can use that you can use
cake you well for that coostery language
used in various Services Now
is als so using it so Highway
recommended To start Learning that
On Top beval The Different languages
that you already need to learn and me to
know en It collect all the reason all
the day From The Different addur
Resources automatic
If We den Look at container Insights
That Is What We Just enabled on top of a
k s custer completely Free to use but
this offers more information about your
container deployments zo
monitors Performance of your work Loots
That are Deploy to ATS
aircontainer instanties Azur Redhead
open shift en cubanidies custer
clausters That are host it on Ashes
Stack or unpremises zou je Connect al
die types of Resources to it
en What does it private you can really
get Insights Into Your notes You're
containers your name Spaces you can
really Drill Down in What is actually
going on What the Performance is of your
application en als so from your
invitement en you can also configure
alerts On Top of that Maybe you want to
automatically do something When A cpo CP
When The CPU Reach a certon treasual You
Maybe want to email and administrator or
Maybe you want to use some alle some
Skating in that case this can also Be
concreate Me configured Inside Of asger
monitor in this case
zo let's take a look at the monitoring
Services
Let's Go Back
[Muziek]
to home
And that search for
Money hoor
Hero can Easy Use the Search bar for
that and here you can Look Into The
Different Inside are support It Here
Here can see container Insights This is
what we enable Toon heraks cluster you
can also Use the left men YouTube Real
Down so Let's Look at the container
Inside
and here you can see
Which clusters are monitor that is my
APS cluster Because We able that
het klik al niet
en hier je can see All Swords of
information
ehm that is available Note CPU Note
memory not Count
Active podcast All Swords of information
Is Here
we can also take a look at the work-load
dead Order
Oh I don't permissions to this
Strange Spaces Oké let's do with the
bitterfund
no pols
One Note pool that is Deploy
detroited with a Different account
at some of the
Let's go back to a custer
Oké let's take One Step Back because
Let's go back to a monitor servers Now
I'm Inside My cluster
Oké we go to containers Again
Tour monitor clusters
selected cluster Again
en here you can All so see that you can
create various workbooks On Top of that
so There are Works books
for your networking Your gbu your data
usage your disco
all out of the box workbooks
of Time
Before kicks in
Here can see that you can really Drill
Down Into Your Note Pools Into Your
Services
You Can Get lots of data
en de Performance of your Services so
really Take Sometimes to Dive in to that
en Let's now take a look at the out of
the box
alerting There Was some recommended
alerts available Dit is stil een preview
but here you can see what Microsoft
actually recognments to turn on for you
so Let's click on recommended alerting
and here you can see that I already
enabled one of Desert
Number of alerts that you can Pick from
I Use the container CPU so Let's click
on it
zo in my case When The CPU is greater
reaches a certen level den
e-mail will be stand Out To One Of My
administrators
with some details
but you can also configur this
differently to actually automatically do
something Without The Need That in that
midtersteater is going to be not a Fight
Maybe add some extra notes To It
or Maybe eh regroup somethings you can
All configure That Inside Of The
alerting Rules
laat stop ik Microsoft Defender for
Cloud
What becovered previously the monitoring
capabilities and Services Those are all
free Services to you but if you have
More Enterprise Great security features
or requirements or features needed den
Microsoft Defender for Cloud can be a
good edition on top of that
is really ads a Different Layer of
security On Top Of Your asher platform
s you a security dashboard with a
centralized View for Azure AWS Google
Cloud So you can really use a multicloud
invironment and Use the defendertooling
to Secure that
On Top of that it also have some focust
Fuse If you can really Drill Down Into
Your Security posture
Secure score is fully integrated into It
Secure score is a feature Inside Of
Azure that uses the well architect The
framework Underneath and gives you
advice based on your deployed Services
en als ze Give You The Billy to
remediated automatically
There are 4 More Than 450 out of the box
recommendations That are coming from
secury score So It can really give you a
good overview of What is actually going
on your invirmed and how you can
configurate togeth It More compliance en
toen make Shore that is in Line with
your security uh standards of your
organization
Defender for Cloud Products It is really
a bit confusing
you have Defender for servers for
Storage for Sequel for containers Which
We are going to use in the next demo For
Your absurfer For Your keyfault
DNS
relational dtbasis en cosmosdibi They
can alby enabled independently from each
other
maar dat is een bit confusing en a bit
overwelling When You First start with
Defender for Cloud
So What is the support
that is important for container security
of course Microsoft Defender for
Containers
en Microsoft Defender for kival en for
keyboard
Events It really scance What is actually
going on Who is requesting the Different
password Secrets or certificate so Give
You really good overview of What is
actually on in your keyboard Who is
Access Do It en who doesn't need to have
Access Do It
voor Defender voor containers There are
couple of Services daddy supports
Office support for environment harding
assessment On Top Of Your images That
are stored Inside Of Your acr in farmen
en also What is Running Inside Of Your
ATS invit en het Give You runtime Track
protection For Your notes and your
clusters
zo security alerts are generated When
The Wars Suspicious activities going on
Inside Of Your clusters
solidsteken Look at Defender for Cloud
Back to the portal Back To The home page
for Microsoft Defender for Cloud Here
and here you can see the overview Here
can see the security poster
service that is also attitude
Defender for Cloud is quite a expensive
service It really ads a lot of pricing
to your Different Services There is the
way to test this When You First able
this you have a 30 Day Trial period
And then you can create or use a
workbook that is created by the
Community to see what is actually going
on from a building perspective So This
is a good way to test It because it's
really A Black Box
interns of price in
so ivanable The container
de containerservice en de kieville
service in this case
zo'n Let's Go Back for a bit
en let's take a Look At The Different
workbook set hard available
here you can see
The price estimation workbook zo If
You're Going To test this enable this
workbook and take a good Look at It What
is actually going on There is a
container security workbook that you can
use but There also lot so workbooks
already created Why the Community Which
can be downloaded from get hub
so you don't have to Rein Event the
wheel yourself lots of stuff is already
available for you that you can re use
pictor teken
en lyrics
I have some accessible Storage
containers So It really
drills Down into what is actually going
on Inside
is low in this case en ik wil als so
Give You lots of recommendations
Here can see that I have some
valderbilities
That's click on this
I have a very old image Running And that
image is not up to date
so in my case
It Give me a lot of notifications and
warnings did I shoot update My debian
image
So if you klikaan this you will see that
it offs you a lot of remediation
guidance
available you can download that patch
from Here if you want more editional
information you can also Drill Down
ehm to some More Fender information So
It really Gifts you lots of information
and Inside to actually securior images
in this case are your infernment en je
see Which Type of Resources are
effective lots are Resources I will need
to do something about this
so we already Look at the Kendall bit to
the securs core part here you can see
the Security pastore
de zus Secure score dashboard en dit is
al
display accordingly to the well
architect this framework en al die
guidlines That are part of that
framework
you can Drill Down to your
subscription
and Here With Wheel also already oh you
get the same remediation orde the same
warnings And The Score Around It Here is
well and you can remediated from Here
immediately if you want to
zodat was The Last demo a couple of key
takeaways of course there a lot of Third
party tools Around security available
From The Edge marketplaces well you
don't need to use the building security
tools There is support for Aqua
twistlock you can Easily you eh Deploy
Them from inside of the Ash and
marketplace
container Inside is de Insights is de
free service On Top of Azure that you
can use You don't have to pay Anything
extra wit When You're going to use
Defender for Cloud Please Be aware of
the price in
because It really increases Your your
monthly invoices on asher
so That's It are there Any questions
All The Same ja
Ja correct
and the other questions
Oké thank you and Enjoy
[Applaus]