54:45This recording is not available yet.
What is NeuVector and how does it help to secure and prevent attacks in Kubernetes?
Download resourcesCategories
Application SecurityDevSecOpsCloud SecurityCloud-Native & ContainersNetwork Security & Zero TrustZero Trust
Sponsored by
About this session
Gaetan Trellu, solutions architect at SUSE, gives a French-language, hands-on walkthrough of NeuVector, SUSE's open-source Kubernetes security tool acquired in 2021. He frames the modern problem: Kubernetes clusters are ephemeral and their pod network is flat with no VLAN-style segmentation, so east-west traffic between unrelated pods is possible by default, and layer-4 firewall rules are easy to bypass by tunneling one protocol inside another's port. NeuVector addresses this with eight security layers split across a supply-chain group (vulnerability and compliance scanning against CIS, PCI, HIPAA, GDPR and NIST profiles, plus admission control to block non-compliant deployments) and a runtime group (network segmentation via deep packet inspection up to layer 7, process and file security inside containers, threat detection, DLP for outbound data, and a WAF for inbound traffic). He explains the architecture (Helm-deployed controllers, scanners, a manager UI/CLI/API, and per-node enforcer daemonsets), the three operating modes (discover, monitor, protect) used to learn normal behavior before enforcing it, and how learned rules export as Kubernetes-native YAML to Git for GitOps promotion across environments with RBAC on who can change them. He closes on a three-command install and offers a live demo at the sponsor booth given time constraints.
:
NeuVector provides robust security solutions tailored for Kubernetes environments, effectively mitigating vulnerabilities and preventing malicious attacks. By integrating advanced threat detection, and real-time behavioral analysis, NeuVector ensures comprehensive protection against evolving security threats.
Key takeaways
- Do not assume port number implies protocol inside Kubernetes; deep packet inspection at layer 7 is needed to catch traffic tunneled through a well-known port like 53.
- Run new security tooling in 'discover' mode for one to two weeks before switching to enforcement, so scheduled jobs (cron-style Kubernetes jobs) aren't mistaken for anomalies.
- Export learned network and process rules as Kubernetes-native YAML to Git so staging-learned policy can be promoted to production via GitOps instead of re-learning from scratch.
- Use Kubernetes' native Admission Control webhook to block deployment of images with known critical CVEs before they ever run, rather than only detecting the problem afterward.
- Apply RBAC to who can create or modify security policy CRDs; developers should get notified when their deployment is blocked, not direct access to loosen the rules themselves.
Speakers
Gaëtan Trellu
Solution Architect with 20 years in open source, delivering software and technology projects from start-ups to Fortune 100.
