DEVOPSdigest

Aqua Security announced the availability of version 3.0 of its platform featuring new security automation and controls for Kubernetes-based runtime environments.

The new release also introduces more than 120 additional features, extending the capabilities of the company's end-to-end container security platform to address the requirements of today's multi-platform enterprise customers, from securing the build pipeline and enabling DevSecOps, to runtime protection of workloads.

As part of its 3.0 launch, Aqua also unveiled patent-pending MicroEnforcer architecture to deliver runtime security for Container-as-a-Service environments.

"Kubernetes adoption has been increasing along with the maturity and enterprise-readiness of its features," noted Liz Rice, Technology Evangelist at Aqua Security. "With the enterprise security skill shortage, enterprises are looking for ways to leverage Kubernetes to automate deployments and accelerate application delivery, at scale, without compromising on security. That's what Aqua 3.0 is all about."

Aqua 3.0 builds on Kubernetes security capabilities to provide automated Kubernetes-native controls in several key areas:

- Kubernetes-Native Role Based Access Controls: Aqua 3.0 enables customers to leverage Kubernetes webhook admission controller to create fine-grained user access control roles and policies, controlling access to kubectl commands, governed by Aqua's scalable labeling scheme. This enables security teams to govern access across teams, with full segregation of duties.

- Kubernetes-Native Image Assurance Controls: In addition to its ability to block unapproved images from running at the individual host level, Aqua can now prevent Kubernetes from running unapproved images across entire clusters, providing a more efficient mechanism that scales across large deployments.

- Kubernetes-Native Network Controls: Aqua's container-level firewall now enables admins to control network traffic based on Kubernetes namespaces, clusters or deployments. This allows admins to enforce network segmentation for compliance purposes, as well as limit an attack's "blast radius" across clusters and applications.

- CIS Kubernetes Benchmark: Building upon Aqua's open-source Kube-Bench, the tool widely used by the community to validate the security posture of Kubernetes deployments, Aqua now incorporates CIS Kubernetes benchmark checks alongside updated Docker CIS benchmark checks. Automated checks can run daily, providing a detailed report that can also be exported for compliance.

- Kubernetes Context in Audit Events: Aqua's event logging now includes Kubernetes-specific information, such as pod name, type, deployment and namespace data, providing additional visibility for compliance and forensics.

The Aqua platform drives DevSecOps automation, and provides visibility and runtime protection for cloud-native workloads, including both host-level and network-level controls.

Aqua 3.0 is compatible with implementations of Kubernetes 1.8 or newer, and is available to existing Aqua customers. It is certified on popular Kubernetes-based deployments, including Azure AKS and ACS, Google GKE, Amazon EKS, and RedHat Openshift, and is a Kubernetes Technology Partner.

Aqua 3.0 also introduces many other new features, including malware scanning for images and hosts, vulnerability scanning for hosts, and enhanced support for network plug-ins Flannel, Calico, Weave and Contiv.

Additionally with version 3.0, Aqua unveils its patent-pending MicroEnforcer technology for securing "zero infrastructure" container-as-a-service offerings. The new, patent-pending technology that provides runtime security controls for applications running in a public cloud container-as-a-service (CaaS) environment where the user does not manage VM instances or hosts.

MicroEnforcer technology inserts security controls into the container early in its development lifecycle. As the container image is built, the MicroEnforcer is embedded into it in a way that later allows it to monitor and control instantiated containers, including the ability to prevent specific unauthorized container activities.

Aqua MicroEnforcer secures containers wherever they run:

- It identifies malicious activity, such as access to unauthorized networks or attempts to inject code into the container, and prevents these attempts at runtime;

- It securely injects secrets into containers that are authorized to use them at runtime, leveraging existing enterprise secrets stores;

- All alerts generated by MicroEnforcer are sent to the Aqua Command Center, which in turn can send them to integrated SIEM and analytics tools.