SlideShare a Scribd company logo
Securing Your Apps & APIs
in Kubernetes
VIRTUAL EVENT
Aug 27th, 2020
| ©2020 F5 NETWORKS - CONFIDENTIAL2
| ©2020 F5 NETWORKS - CONFIDENTIAL3
| ©2020 F5 NETWORKS - CONFIDENTIAL4

Recommended for you

Control Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINXControl Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINX

On-Demand Recording https://www.nginx.com/resources/webinars/control-kubernetes-ingress-egress-together-nginx/ About the Webinar Join our resident Kubernetes and modern apps experts in a discussion of the challenges of Kubernetes traffic management in today’s technology landscape. While Kubernetes Ingress gets most of the attention, how you handle egress traffic is just as important. Egress isn’t just about traffic leaving a cluster, either, but also concerns traffic among managed and unmanaged services within the cluster. We demo a solution using NGINX Service Mesh and NGINX Ingress Controller to control egress from the cluster and between NGINX Service Mesh and unmanaged services. Whether you’re new to modern application architectures, or looking to improve your current microservices deployment, this webinar is for you. Speakers: Amir Rawdat Technical Marketing Engineer F5 Faisal Memon Software Engineer F5

kubernetesnginxingress controller
Secured APIM-as-a-Service
Secured APIM-as-a-ServiceSecured APIM-as-a-Service
Secured APIM-as-a-Service

In our digital world, customers expect a compelling, reliable digital experience and partners want frictionless integration with your services. One of the most critical underpinnings to digital success is the application programming interface (API). APIs are the common currency for transacting in the digital world. API traffic now constitutes 83% of the world’s internet traffic and 70% of organizations have invested in API management. Join us for this session API-as-a-Service: How an Internal API Cloud Can Accelerate Digital Transformation.

nginxapiapi management
Application Security with NGINX
Application Security with NGINXApplication Security with NGINX
Application Security with NGINX

About the Webinar In this webinar we demonstrate how to implement effective security controls for your application infrastructure, without impacting release velocity or application performance. Join Chris Witeck and Rajiv Kapoor as they showcase NGINX App Protect and the upcoming security capabilities within NGINX Controller, with specific business use cases in mind. On-Demand Link: https://www.nginx.com/resources/webinars/application-security-nginx/

secopsdevopsnginx
| ©2020 F5 NETWORKS - CONFIDENTIAL5
There’s two types of apps in this world….
Greenfield Brownfield
| ©2020 F5 NETWORKS - CONFIDENTIAL6
Ok, so maybe that’s an oversimplification….
Brownfield
Greenfield
| ©2020 F5 NETWORKS - CONFIDENTIAL7
And they often are mixed together
7
Monolithic Hybrid Microservices
Modernization
>60%
Core, legacy
business apps
~30%
Legacy with micro-
services add-ons
~10%
Modern apps
optimized for digital
Statistics from 2018 NGINX Brand Survey
Where most enterprises will be
for years to come
| ©2020 F5 NETWORKS - CONFIDENTIAL8
Current CNCF Landscape

Recommended for you

NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale

Speakers: Alan Murphy, Regional Solution Architect for APAC NGINX, Inc. Karthik Krishnaswamy, Senior Product Marketing Manager at NGINX, Inc. About the webinar Deploying and managing applications at scale always presents challenges. Infrastructure has to be configured and provisioned quickly across multiple public and private clouds. There’s ever-increasing pressure to maintain reliability, performance, and availability of business applications across this disparate infrastructure. Easy workflows for infrastructure and DevOps, as well as self-service management capabilities for developers, are needed to accelerate application deployment. The result? Enterprises are able to innovate and bring apps to market faster. That’s where NGINX Controller comes in. Controller helps users manage multiple NGINX instances at scale with centralized configuration, monitoring, alerting, and troubleshooting.

nginxnginx controllernginx instances
NGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEANGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEA

NGINX powers over half of the world’s busiest sites and applications. Attend this NGINX Basics webinar to hear answers to questions about NGINX and NGINX Plus. https://www.nginx.com/resources/webinars/nginx-basics-ask-anything-emea/ Watch this webinar to: - The answers to your questions on NGINX - About how others use NGINX and NGINX Plus - About common application delivery design patterns - Key insights from the presenter' more than 20 years of industry experience

nginxnginx plus
NGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJNGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJ

In this webinar we help you get started using NGINX, the de facto standard building block for modern microservices-based architectures. Using a hands-on, follow-the-trainer style, in this workshop we take you through installing and configuring NGINX as a web server, load balancer, and reverse proxy. On-Demand Link: https://www.nginx.com/resources/webinars/nginx-basics-apcj/

nginxreverse proxyload balancing
| ©2020 F5 NETWORKS - CONFIDENTIAL9
Ok, that’s a lot.
What do I need to think about to start ramping towards actually
getting to production?
What flavor of Kubernetes am I going to leverage?
Cloud Services
Cloud Services
Hybrids
Vanilla
Agnostic
| ©2020 F5 NETWORKS - CONFIDENTIAL10
Ok, that’s still a little more complicated than expected
Is there anything I can do regardless of my platform choice?
Sure, and we’re about to focus on a couple of them.
Figure out your application routing, monitoring, and security strategy
Platform agnostic tool chain = solve the problem once, solve it for good
| ©2020 F5 NETWORKS - CONFIDENTIAL11
Ingress
Controller
pod
pod
pod
pod
pod
Per-Pod proxy
Per-Service
proxy
Kubernetes adds several more locations
to deploy Application Services
API Gateway
Load Balancer
App Security
Four locations to deploy Application Services:
• Edge: External load balancers and proxies
• Ingress Controller: Entry-point into Kubernetes
• Per-Service Proxy: Interior service proxy tier
• Per-Pod Proxy: Sidecar-style proxy per pod
Edge
| ©2020 F5 NETWORKS - CONFIDENTIAL12
Three criteria to determine where to deploy a
service
1. Is the service specific to an application, or general, for all applications?
Close to the Application Close to the Edge
3. The Technical Fit – what components offer the necessary functionality and APIs?
2. Is the service configuration owned by DevOps/DevSecOps, or by NetOps/SecOps?
Owned by Dev(Sec)Ops Owned by NetOps/SecOps
Not app components are equal, and different configuration and APIs meet needs of different users

Recommended for you

NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controllerNGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller

NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller slides. This event was held at Cutters Crabhouse in Seattle, WA on March 14th.

kubernetesnginxcontroller
Fundamentals of microservices
Fundamentals of microservicesFundamentals of microservices
Fundamentals of microservices

On-Demand Link: https://www.nginx.com/resources/webinars/fundamentals-microservices/ About the Webinar Despite powering some of the most popular apps on the planet, microservices – including containers and Kubernetes – are still a mystery to many. Microservices is both an approach to software architecture that builds a large, complex apps from multiple small components and the term for the small components themselves. In this “Microservices 101” webinar, you’ll get an introduction to microservices that will give you a working understanding of the technologies: Monolithic, microservices, and hybrid architectures Containers and Kubernetes Ingress controllers and service meshes

microservicesnginx microservicesnginx
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service MeshData Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh

On-Demand Link: https://www.nginx.com/resources/webinars/service-mesh/ About the Webinar Join us for a special launch webinar as we introduce you to NGINX Service Mesh, our new offering as part of the NGINX product suite. In this webinar, you’ll learn about using NGINX Plus and NGINX Controller as part of your microservices journey, why your organization may need a service mesh to improve performance and reliability of your applications, and how NGINX Service Mesh can help you meet these needs. Our presenter(s) will also provide a demonstration of NGINX Service Mesh, giving you an insight into the new experience that awaits you and your team.

nginxnginx service meshmicroservices
| ©2020 F5 NETWORKS - CONFIDENTIAL13
• Native open-source integration
in container environments for F5
BIG-IP Ingress control
• Enable self-service selection in
orchestration for app services
• Scale and secure apps through
automated event discovery and
service insertion
• Scale and secure NGINX Ingress
controller
F5 Container Ingress Services (CIS)
F5 Container Ingress Services
Container Environments
Visibility and
Analytics
F5 BIG-IP
App Performance and
Security Services
F5 Container
Ingress Services
Orchestration
Dotted line = integration control plane
Solid line = traffic data plane
AppServicesAcrossNetwork
Node 2Node 1
Kubernetes
Openshift
| ©2020 F5 NETWORKS - CONFIDENTIAL14
• Single pod deployment, running
in Kubernetes as nodeport
• Rich, app-oriented configuration
using both Kubernetes and
NGINX Ingress Resources
• Supports DevOps use cases:
routing, B/G, circuit breaker
• Multi-tenant, secure RBAC
• Typically requires external LB
NGINX Ingress Controller
NGINX Ingress Controller
Container Environments
Visibility and
Analytics
Orchestration
Dotted line = integration control plane
Solid line = traffic data plane
AppServicesAcrossNetwork
Node 2Node 1
Kubernetes
Openshift
Tracing
| ©2020 F5 NETWORKS - CONFIDENTIAL15
Ingress Controller as point of control for App Protect
Ingress
Controller
Edge Services
pod
pod
pod
pod
pod
Customer
DevOps requests additional
capabilities using Ingress
Resource extensions
Kubernetes Control Plane
NGINX
Ingress
Resource
WAF policy
DNS policy
IPAM policy Ingress Controller automates
downstream services, within
boundaries controlled by NetOps
Automated discovery and
High-Performance Load Balancing
| ©2020 F5 NETWORKS - CONFIDENTIAL16
WAF Deployment on the Ingress Controller
DEPLOY WAF POLICIES ON THE INGRESS CONTROLLER, CONFIGURED USING KUBERNETES API
Ingress
Controller
pod
pod
pod
pod
pod
Per-Pod proxy
Per-Service
proxy
Edge
K8s NetOps/DevOps-Centric Approach
Appropriate solution when WAF policies are
under direction of NetOps or DevOps teams.
Policies are defined and associated with
services using Kubernetes API.
NGINX Ingress Controller RBAC allows:
• Admin users to enforce policies per listener
• DevOps users to select policy per Ingress
Resource
Leverage Container Ingress Services to
scale NGINX Ingress Controller and add other
application services (LB, DNS, DDoS, IAM).
Appropriate for Kubernetes-native NetOps or DevOps WAF

Recommended for you

Kubernetes Networking
Kubernetes NetworkingKubernetes Networking
Kubernetes Networking

This document outlines the agenda for a virtual networking event on Kubernetes networking. The agenda includes: - A welcome and trivia session from 11:30-11:35AM - Two technical sessions from 11:35AM-12:20PM presented by Chris Akker, Jason Williams, and Jon Calalang - A Q&A session from 12:20-12:30PM - Closing at 12:30PM The document also includes information about NGINX and its application platform suite, the NGINX ingress controller, NGINX Plus ingress controller demonstrations, and F5's Container Ingress Services.

nginxf5kubernetes
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEAReplacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA

The way we build applications has changed a lot since 1996, when F5 BIG-IP was released. Companies that use F5 BIG-IP complain of high cost and lack of agility. In this webinar we describe how to replace or augment your F5 BIG-IP deployment with NGINX Plus for cost savings and greater agility. Watch this webinar to learn: - A brief history of F5 Networks and the BIG-IP, from initial release to early success - About five industry trends that are disrupting F5 and making F5 BIG-IP a hindrance to the modern enterprise looking for agility - Three ways to gracefully replace or augment F5 BIG-IP with NGINX Plus, without having to rip and replace - About application architectures possible with NGINX Plus, but not with F5 BIG-IP, such as API gateways https://www.nginx.com/resources/webinars/replacing-augmenting-f5-big-ip-nginx-plus-emea/

nginxnginx plusf5
How to Get Started With NGINX
How to Get Started With NGINXHow to Get Started With NGINX
How to Get Started With NGINX

On-Demand Recording: https://www.nginx.com/resources/webinars/how-to-get-started-with-nginx/ In this webinar, we help you get started using NGINX, the de facto standard building block for modern microservices-based architectures. During this practical workshop, we take you through installing and configuring NGINX as a web server, load balancer, and reverse proxy.

microservicesnginxweb server
NGINX App Protect
CHRIS AKKER
TECHNICAL SOLUTIONS ARCHITECT
NGINX BU / F5
| ©2020 F5 NETWORKS - CONFIDENTIAL18
0
2000
4000
6000
8000
10000
12000
14000
16000
2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
YoY Increase in CVEs
Note: Excludes any rejections or disputes.
New vulnerabilities are
discovered in all
manner of software all
the time
They are exploited by both
malicious bots and human attackers
Do you know how many affect your
application stack(s)?
Can you keep up with the pace of
published vulnerabilities?
Do you want to?
| ©2020 F5 NETWORKS - CONFIDENTIAL19
Strong App
Security
Built for
Modern Apps
CI/CD
Friendly
NGINX App Protect
| ©2020 F5 NETWORKS - CONFIDENTIAL20
Strong App Security
App security and controls built using
F5 Advanced WAF technology.
Blocks attacks and helps prevent
downtime.
Easy Install & Updates
OWASP Top 10
And More
Regulatory Compliance
IP Blocking Prevent sensitive
data loss
F5-based Layer 7
Attack Protection
API Security

Recommended for you

Découvrez NGINX AppProtect
Découvrez NGINX AppProtectDécouvrez NGINX AppProtect
Découvrez NGINX AppProtect

F5 et NGINX vous présentera son nouveau WAF NGINX App Protect. Venez découvrir comment F5 a réussi à créer un WAF homogène et complémentaire de la solution F5 BIG-IP Advanced WAF.

f5big-ipnginx
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of UnitNGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of Unit

Nick Shadrin, Product Manager for NGINX Unit, describes how Unit is being used, now that it's in general release and new features are being added. Nick will suggest ways that you can deploy Unit to get the most out of it, talk about how Unit is being used in production in the enterprise, and the future of Unit.

nginx unitnginxenterprise
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...

Building and deploying cloud native APIs is a complex operation, and can require a multitude of components. In this workshop we focus on the fundamentals of deploying the runtime API code and publishing the API through an API gateway. To achieve this we use NGINX Unit as a polyglot application server and NGINX web server as an API gateway. With this combination we deliver a solution lightweight enough for dev and strong enough for production. You will learn how to use NGINX Unit to run one or more apps and APIs in a variety of languages, including seamlessly deploying new versions. You will then see the best practices for how to configure NGINX to perform the common API gateway functions of request routing, rate limiting, and authentication for multiple APIs. We will also touch on advanced use cases such as HTTP method enforcement, and JSON validation. No previous experience of NGINX or NGINX Unit is required, but a basic knowledge of HTTP and JSON/REST APIs is valuable.

nginx unitapiwebserver
| ©2020 F5 NETWORKS - CONFIDENTIAL21
Built for Modern Apps
High performance security with
performance and scale
Small Footprint, less than 2MB on disk
– ideal for Container workloads
Seamless integration into the #1 web application platform
High performance
Deployment options Minimizes tool
sprawl
Lightweight
footprint
Seamless NGINX
Integration
20X+ faster than
alternative OSS
| ©2020 F5 NETWORKS - CONFIDENTIAL22
CI/CD Friendly
Enable security to keep pace with
DevOps and Support “shift left”
initiatives
Declarative policies
Speed Time to
Market
Reduced cost
Enable AppDev
Feedback loops
Automate security
in CI/CD cycle
| ©2020 F5 NETWORKS - CONFIDENTIAL23 CONFIDENTIAL
Signature Differences
Attack Signature Threat Campaign
Generic form of attack Instance of a specific attack
Many false positives Near 100% accurate
Difficult to evade Sensitive to attack variations
Updated once in couple of weeks Multiple updates per week
No information if ever exploited Based on real observations
Generic attack information Provides Context (Intent/Risk)
Local attack indicator Global threat visibility
~4,000 ~200
| ©2020 F5 NETWORKS - CONFIDENTIAL24
Deployment
options /
Use Cases
 Edge SW WAF
 API WAF
 Kubernetes IC WAF
 Pod WAF
 Microservice WAF

Recommended for you

Global Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINXGlobal Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINX

On-Demand Link: https://www.nginx.com/resources/webinars/global-server-load-balancing-ns1-nginx/ About the Webinar How do you improve performance and high availability across your data centers or points of presence (PoPs)? By entrusting your DNS, DHCP, and IP address management (DDI) to NS1. Built on a modern API-first architecture that acts on real-time data, NS1’s DDI platform is an intelligent, efficient, and automated system. Deployed behind NS1 or F5, NGINX is an all-in-one software load balancer, content cache, web server, reverse proxy, and API gateway. Attend this webinar to learn about how NGINX integrates with NS1 to improve reliability and resilience.

load balancingns1nginx
Nim tames sprawl
Nim tames sprawlNim tames sprawl
Nim tames sprawl

About the Webinar App developers and DevOps teams at more than 400 million websites rely on NGINX for a wide range of app delivery functions – load balancer, API gateway, reverse proxy, and web server. But the more NGINX instances you have, the bigger the challenge in keeping track of them all. That’s where NGINX Instance Manager comes in. Join this webinar to learn about a new solution called NGINX Instance Manager that helps you to effortlessly discover, configure, and monitor NGINX Open Source and NGINX Plus instances at scale. The webinar includes a demo of NGINX Instance Manager in action. Tom Gamull Product Manager, F5 Karthik Krishnaswamy Director, Product Marketing, NGINX

dynamic configurationopen sourcenginx
What's New with NGINX Application Security Solutions
What's New with NGINX Application Security SolutionsWhat's New with NGINX Application Security Solutions
What's New with NGINX Application Security Solutions

On-Demand Link - https://bit.ly/3iqfU6b Learn about defending modern applications from advanced threats as well as how the latest updates to the NGINX security portfolio help organizations democratize security for app teams.

nginx plusnginxapplication
| ©2020 F5 NETWORKS - CONFIDENTIAL25
Ingress
Controller
pod
pod
pod
pod
pod
Per-Pod proxy
Per-Service
proxy
Kubernetes adds several more locations
to deploy Application Security
API Gateway
Load Balancer
App Security
Four locations to deploy Application Services:
• Edge: External load balancers and proxies
• Ingress Controller: Entry-point into Kubernetes
• Per-Service Proxy: Interior service proxy tier
• Per-Pod Proxy: Proxy embedded in pod
Edge
Standard App Protect
NGINX-Proxy deployment
| ©2020 F5 NETWORKS - CONFIDENTIAL26
Declarative Policy Helps CI/CD Motion
INFRASTRUCTURE AND SECURITY AS CODE
Source Code Repository CI/CD Pipeline Tool IT Automation
Application code/config for App X
security policy/config for App X
Pipeline for build/test/deploy of App X
Ansible playbook for deployment
of App X with its app services
Owned by SecOps Operated by DevOps
{
"entityChanges": {
"type": "explicit"
},
"entity": {
"name": "bak"
},
"entityKind": "tm:asm:policies:filetypes:filetypestate",
"action": "delete",
"description": "Delete Disallowed File Type"
}
Demo Highlights
ENVIRONMENT OVERVIEW
NGINX PLUS WITH APP PROTECT - EDGE
NGINX PLUS KUBERNETES INGRESS WITH APP
PROTECT
ELK – KIBANA DASHBOARDS EXAMPLE
357 Demo
3 INSTALL COMMANDS
5 LINES OF CONFIGURATION
7 MINUTES TO RUNNING APP PROTECT

Recommended for you

Application Security with NGINX | APAC
Application Security with NGINX | APACApplication Security with NGINX | APAC
Application Security with NGINX | APAC

About the Webinar In this webinar we demonstrate how to implement effective security controls for your application infrastructure, without impacting release velocity or application performance. Join Chris Witeck and Rajiv Kapoor as they showcase NGINX App Protect and the upcoming security capabilities within NGINX Controller, with specific business use cases in mind. On-Demand Link: https://www.nginx.com/resources/webinars/application-security-nginx-apcj/

nginx plusnginxapp protect
F5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-CloudF5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-Cloud

This document discusses how F5 and HashiCorp can help with multi-cloud application delivery and management. It highlights challenges like maintaining security and performance across clouds. It presents the F5 and HashiCorp product suites that provide automation, infrastructure as code, service discovery, and secrets management. These solutions help improve consistency, reduce friction between teams, and enable self-service provisioning through declarative APIs and templates.

Secure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINXSecure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINX

On-Demand Recording: https://www.nginx.com/resources/webinars/secure-your-kubernetes-apps-from-attacks-with-nginx/ With more and more organizations conducting business with their customers online, web applications remain the top attack target for cybercriminals. It’s easy to see why; they are often complex, composed of microservices, and spanning distributed environments, increasing the number of endpoints vulnerable to exploitation. It is no surprise that OWASP Top 10 vulnerabilities such as SQL injection and cross scripting (XSS) remain popular cyberattacks. You need to strengthen security for your containerized apps deployed in Kubernetes by adding a WAF to NGINX Ingress Controller. In this webinar we look at the cost of a typical application hack and why traditional WAFs don’t work for today’s modern applications. We conclude with a demo that showcases how by combining NGINX Ingress Controller with NGINX App Protect WAF you can protect your apps against common vulnerabilities, create granular policies for app services, and make your Kubernetes clusters a safer place to run your apps.

kubernetesweb applicationscybersecurity
Demo
Environment
Centos Server,
3-node K8s
cluster, N+ KIC,
ELK Server
| ©2020 F5 NETWORKS - CONFIDENTIAL30
Centos# yum install –y app-protect
Centos# yum install –y app-protect-attack-signatures
Centos# yum install –y app-protect-threat-campaigns
3 - Install AppProtect on Centos 7
Pre-Reqs
1. Need your NginxPlus Repo SSL nginx.crt and nginx.key
2. Add the App-Protect Signatures yum repo
Centos# wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-signatures-7.repo
| ©2020 F5 NETWORKS - CONFIDENTIAL31
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
load_module modules/ngx_http_app_protect_module.so; #Dynamic Module
…
server {
listen 80;
server_name localhost;
proxy_http_version 1.1;
app_protect_enable on; #Enable AppProtect
app_protect_policy_file "/etc/nginx/NginxDefaultPolicy.json"; #Policy Definition
app_protect_security_log_enable on; #Enable logging
app_protect_security_log "/etc/nginx/log-default.json”
syslog:server=10.1.20.6:5144; #Syslog IP:port
location / {
…
proxy_pass http://k8s.arcadia-finance.io:30274$request_uri;
}
}
5 – Configure Nginx.conf with AppProtect
| ©2020 F5 NETWORKS - CONFIDENTIAL32
Centos# systemctl restart nginx
Centos# cat /var/log/nginx/error.log
Centos# curl –k http://localhost
Centos# curl –k “http://localhost/?<script>”
7 – Running NginxPlus with AppProtect

Recommended for you

F5 Distributed Cloud.pptx
F5 Distributed Cloud.pptxF5 Distributed Cloud.pptx
F5 Distributed Cloud.pptx

This document discusses F5 Distributed Cloud Services, which provides networking, security, and application delivery services across cloud, on-premises, and edge environments from a centralized SaaS console. It addresses challenges like complexity in coordinating technologies, automation, security across attack surfaces, and limited observability. The platform offers a unified view with centralized management, advanced security, full-stack observability, and automation. Use cases include hybrid/multi-cloud networking, web app and API protection, and running apps globally in cloud and edge. It is delivered via F5's global private network and provides value to DevOps, SecOps, and NetOps teams.

Infrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale OrganizationsInfrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale Organizations

The adoption of tools for the provisioning and automatic configuration of "Infrastructure as Code" (eg Terraform, Cloudformation or Ansible) reduces cost, time, errors, violations and risks when provisioning and configuring the necessary infrastructure so that our software can run . However, those who have begun to make intensive use of this technology at the business level agree to identify the emergence of a very critical problem regarding the orchestration and governance needs of supply requests such as security, compliance, scalability, integrity and more. Learn how The Digital.ai DevOps Platform (formerly XebiaLabs DevOps Platform) responds to all these problems and many more, allowing you to continue working with your favorite tools.

applicationapplication release automationapplication release orchestration
Nginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lkNginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lk

NGINX AppProtect is a web application firewall (WAF) module for NGINX Plus that provides security protections beyond just signatures. It offers a lightweight software package that can be installed on top of NGINX Plus and leverages F5's core WAF technology. NGINX AppProtect provides high performance, security protections beyond signatures, simple CI/CD integration, and is designed for modern infrastructures.

cncfnginxkubernetes
| ©2020 F5 NETWORKS - CONFIDENTIAL33
Demo Ingress YAML with App Protect
NGINX App Protect
WRAP UP
SIZE ?
PERFORMANCE ?
RESOURCES
| ©2020 F5 NETWORKS - CONFIDENTIAL35
Yum info app-protect
Name : app-protect
Arch : x86_64 Version : 22+3.90.2 Release : 1.el7.ngx
Size : 172 k
Repo : installed
From repo : nginx-plus
App Protect Repo
| ©2020 F5 NETWORKS - CONFIDENTIAL36
Yum info app-protect-attack-signatures
Name : app-protect-attack-signatures
Arch : x86_64 Version : 2020.08.19 Release : 1.el7.ngx
Size : 1.3 M
Repo : installed From repo : app-protect-signatures
Summary : app-protect-attack-signatures-rpm
License : Commercial
App Protect Signatures Repo

Recommended for you

Deploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native KubernetesDeploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native Kubernetes

Using cloud-native application services is easy, it “just works”. Many customers choose them without giving it a second thought. However, these app services vary from cloud to cloud, with differing levels of quality and numbers of features making visibility and control inconsistent across clouds. And then there is cost…it’s hard to know what your deployment is going to cost until after it’s been built. Often the services must be compiled in a piecemeal fashion and many products carry bloated code that increases costs. Finally, security is often an afterthought. Moreover, SecOps teams struggle to keep up with the breakneck app release cadence that has become typical. Often they are seen as DevOps viewing them as a major constraint on the ability to deliver software quickly. In this workshop, we showcase the NGINX solutions for cloud native Kubernetes that will allow you to: - Reduce tool sprawl and provide a standard set of services - Control costs with lightweight and easy solutions - Bring teams together with automation and self‑service capabilities

open22opensourcenginx
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021

Achieving DevSecOps Outcomes with Tanzu Advanced Speakers: David Zendzian, Global Field CISCO, VMware Tanzu James Urquhart, Strategic Executive Advisor, VMware Tanzu Mike Koleno, Chief Architect, AHEAD

Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?

Today, one of the big concepts buzzing in the app development world is service mesh. A service mesh is a configurable infrastructure layer for microservices application that makes communication flexible, reliable and fast. Let’s take a step back, though, and answer this question: Do you need a service mesh? Join this webinar to learn: What a service mesh is; when and why you need it — or when and why you may not App modernization journey and traffic management approaches for microservices-based apps How to make an informed decision based on cost and complexity before adopting service mesh Learn about NGINX Service Mesh in a live demo, and how it provides the best service mesh option for container-based L7 traffic management

nginxf5service mesh
| ©2020 F5 NETWORKS - CONFIDENTIAL37
Yum info app-protect-threat-campaigns
Name : app-protect-threat-campaigns
Arch : x86_64 Version : 2020.08.24 Release : 1.el7.ngx
Size : 113 k
Repo : installed From repo : app-protect-signatures
Summary : app-protect-threat-campaigns-rpm
License : Commercial
Threat Campaign Repo
| ©2020 F5 NETWORKS - CONFIDENTIAL38
NGINX App Protect Performance
0
0.5
1
1.5
2
2.5
Throughput (MB/sec)
No Protection NGINX App Protect ModSec
0
2000
4000
6000
8000
10000
12000
14000
Requests/sec
No Protection NGINX App Protect ModSec
0
100
200
300
400
500
600
700
800
Latency (ms)
No Protection NGINX App Protect ModSec
Comprehensive security policy has no impact on latency, and offers better throughput and
requests/second when compared to ModSec
• ModSec Configuration: OWASP Top 10 (enable all CRS v3 rules)
• NGINX App Protect Configuration: OWASP Top 10 (Enable signatures), Evasion technique, Data Guard, Disallowed file types, HTTP
protocol compliance​
| ©2020 F5 NETWORKS - CONFIDENTIAL39
Nginx App Protect Resources
● https://www.nginx.com/products/nginx-app-protect/
● https://docs.nginx.com/nginx-app-protect/admin-guide/#
● https://www.nginx.com/blog/nginx-app-protect-1-0-released/
Nginx Threat Campaigns
● https://www.f5.com/pdf/products/f5_threat_campaigns_waf.pdf
NGINX Ingress Controller with App Protect
● https://www.nginx.com/blog/securing-apps-in-kubernetes-nginx-app-protect/
● https://github.com/nginxinc/kubernetes-ingress/tree/master/examples/appprotect
● https://github.com/nginxinc/ansible-role-nginx-app-protect
Resources
| ©2020 F5 NETWORKS - CONFIDENTIAL40
Questions?

Recommended for you

F5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облакаF5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облака

Презентация Дмитрия Тиховича, Territory Account Manager, RCIS&EE, F5 Networks, на конференции F5 Agility Kyiv (27/11/2014)

applicationwaff5 networks
ciscothousandeyesusecase
ciscothousandeyesusecaseciscothousandeyesusecase
ciscothousandeyesusecase

The document discusses the new enterprise reality of hybrid workers, modern app architectures, software as a service (SaaS) adoption, and agile networks. It notes that enterprise IT is rapidly losing visibility and control as infrastructure is provisioned at the edge and outages can be caused by external providers. ThousandEyes provides cloud and network intelligence to give enterprises deep visibility into every layer of the network and applications to help optimize digital experiences. This includes monitoring application performance, network paths, routing, and correlating data to identify issues. ThousandEyes has agents around the world and integrates with popular platforms.

cisco
Automate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corpAutomate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corp

In this session, Lori Mac Vittie, principal technology evangelist at F5 discusses digital transformation and how F5 and HashiCorp are working together to unlock the full potential of the cloud

f5hashicorp consulconsul
| ©2020 F541
September 15-17, 2020
VIRTUAL EVENT
Sprint is a three-day virtual event designed to inspire and
engage developers, architects, and operators looking to
use NGINX technologies to develop and deliver modern
applications at scale.
www.nginx.com/events/nginx-sprint-2020
GOALS
• Introduce solutions and evolution of NGINX.
• Engage with the NGINX community and users.
• Attract 1,500 live attendees/day.
| ©2020 F542
Day One: Keynotes
SEPTEMBER 15
Duration: 2 hours
Pre-recorded and streamed “live”
• Provide thought leadership,
roadmap review, and announce
new solutions
• Invite external influencers and
maybe customers to present
• Engage audience with post-keynote
analysis from Tech Field Day
Day Two: Demos
SEPTEMBER 16
Duration: 1.5 hours
Live, interactive session
• Provide 6-7 short demos showing of
NGINX and F5 products
• Have demos build on each other,
creating a single app by the end
• Use delegates from Tech Field Day
as audience proxy
Day Three: Hackathon
SEPTEMBER 17
Duration: 2-3 hours
Live streamed session
• Have teams present ideas and
prototypes
• Judge and award winners
| ©2020 F5 NETWORKS - CONFIDENTIAL43
Thank You!
NGINX App Protect
BACKUP SLIDES

Recommended for you

Successfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINXSuccessfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINX

On-Demand Recording: https://www.nginx.com/resources/webinars/successfully-implement-your-api-strategy-with-nginx/ About the Webinar Cloud-native applications are distributed and decentralized by design, composed of dozens, hundreds, or even thousands of APIs connecting services deployed across cloud, on-premises, and edge environments. Without an effective API strategy in place, API sprawl quickly gets out-of-control and becomes unmanageable as the number of APIs in production outpaces your ability to govern and secure them. In this webinar we explore trends that are accelerating API sprawl and look at some well-established best practices for managing, governing, and securing APIs in distributed environments. Our presenters also demo how to use API Connectivity Manager, part of F5 NGINX Management Suite, to streamline and accelerate your API operations.

apiconnectivityf5 nginx
Virtualization / Cloud / SDN
Virtualization / Cloud / SDNVirtualization / Cloud / SDN
Virtualization / Cloud / SDN

This document discusses virtualization, cloud computing, and SDN technologies. It covers some of the key challenges in application provisioning across network layers that can lead to long deployment times. The document presents solutions from F5 that aim to simplify and accelerate application deployments through a high-performance services fabric and integration with technologies like Cisco ACI and VMware NSX to enable automated, policy-based provisioning of load balancing and other application services.

F5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 RoadshowF5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 Roadshow

February 2014 Update on F5 Synthesis Program, delivered by Pat Fiorino in Toronto at the Hockey Hall of Fame. Prepared for IT decision- makers and administrators.

pat misasipat fiorinof5 networks
| ©2020 F5 NETWORKS - CONFIDENTIAL45
| ©2020 F5 NETWORKS - CONFIDENTIAL46
Kibana Overview page
| ©2020 F5 NETWORKS - CONFIDENTIAL47
Kibana Log Entry details
| ©2020 F5 NETWORKS - CONFIDENTIAL48

Recommended for you

VMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes ConnectVMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes Connect

This document provides an agenda and materials for a workshop on VMware Tanzu for Kubernetes Operations. The agenda includes an introduction to challenges faced by platform teams maintaining Kubernetes platforms, an overview of Tanzu for Kubernetes Operations and how it can help address those challenges, and a hands-on lab session. Tanzu for Kubernetes Operations is a collection of products that provide capabilities for common customer needs around managing containerized platforms at scale, including simplified management of Kubernetes clusters across clouds, centralized visibility and security policies, and developer self-service access.

kubernetesvmwarevmware tanzu
One And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptxOne And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptx

Did you know that on average, it takes organizations more than three months using legacy load balancers to scale their load balancing capacity? That includes tedious policy management, expensive over-provisioning (or even more expensive under-provisioning), and the risk of supply-chain delays. Join us for an eye-opening discussion of application delivery done right. By following the guiding principles of a cloud operating model, your team can get operational simplicity, multi-cloud consistency, pervasive analytics, holistic security and full life-cycle automation. This means less time spent on manual, repetitive tasks and troubleshooting, freeing up more time to proactively manage and automate your load balancers.

multi-cloudload balancingvmware
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)

Many organizations anticipate significant growth in WAN bandwidth and Public Cloud usage. Leveraging the Internet to provide extra WAN bandwidth and to offload Public Cloud traffic is compelling, however network reliability, application performance and security are the primary roadblocks. Cisco IWAN transport solution is the most full featured architecture to support the Software Defined Wide Area Network (SD-WAN) requirements that are emerging in standards bodies like the Open Networking User Group (ONUG) to address these issues. Many enterprises are looking for the benefits these technologies deliver, but without the costs associated with owning and operating those technologies. Here is where VMS for IWAN meets market need. Cisco VMS is a full featured management platform for both virtual and physical devices. This session will cover a full description of the VMS platform and how it can be used to deliver exceptional customer experience when supporting a managed offering of IWAN. The roles of Customer and Resource Facing Services will be covered, along with integration between the IWAN service and SP operations. This session will also cover the topic of how Virtual Network Functions (VNFs) can be placed optimally in the network from the CPE to SP datacenter, along with a demo of the end user and operator experience.

cisco connect toronto 2016
| ©2020 F5 NETWORKS - CONFIDENTIAL49
| ©2020 F5 NETWORKS - CONFIDENTIAL50
Arcadia Ingress

More Related Content

What's hot

Securing k8s With Kubernetes Goat
Securing k8s With Kubernetes GoatSecuring k8s With Kubernetes Goat
Securing k8s With Kubernetes Goat
Muhammad Yuga Nugraha
 
Kubernetes and the NGINX Plus Ingress Controller
Kubernetes and the NGINX Plus Ingress ControllerKubernetes and the NGINX Plus Ingress Controller
Kubernetes and the NGINX Plus Ingress Controller
Katherine Bagood
 
Securing Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the CloudSecuring Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the Cloud
Olivia LaMar
 
Control Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINXControl Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINX
NGINX, Inc.
 
Secured APIM-as-a-Service
Secured APIM-as-a-ServiceSecured APIM-as-a-Service
Secured APIM-as-a-Service
NGINX, Inc.
 
Application Security with NGINX
Application Security with NGINXApplication Security with NGINX
Application Security with NGINX
NGINX, Inc.
 
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX, Inc.
 
NGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEANGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEA
NGINX, Inc.
 
NGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJNGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJ
NGINX, Inc.
 
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controllerNGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
Katherine Bagood
 
Fundamentals of microservices
Fundamentals of microservicesFundamentals of microservices
Fundamentals of microservices
NGINX, Inc.
 
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service MeshData Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
NGINX, Inc.
 
Kubernetes Networking
Kubernetes NetworkingKubernetes Networking
Kubernetes Networking
NGINX, Inc.
 
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEAReplacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
NGINX, Inc.
 
How to Get Started With NGINX
How to Get Started With NGINXHow to Get Started With NGINX
How to Get Started With NGINX
NGINX, Inc.
 
Découvrez NGINX AppProtect
Découvrez NGINX AppProtectDécouvrez NGINX AppProtect
Découvrez NGINX AppProtect
NGINX, Inc.
 
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of UnitNGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX, Inc.
 
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
NGINX, Inc.
 
Global Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINXGlobal Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINX
NGINX, Inc.
 
Nim tames sprawl
Nim tames sprawlNim tames sprawl
Nim tames sprawl
NGINX, Inc.
 

What's hot (20)

Securing k8s With Kubernetes Goat
Securing k8s With Kubernetes GoatSecuring k8s With Kubernetes Goat
Securing k8s With Kubernetes Goat
 
Kubernetes and the NGINX Plus Ingress Controller
Kubernetes and the NGINX Plus Ingress ControllerKubernetes and the NGINX Plus Ingress Controller
Kubernetes and the NGINX Plus Ingress Controller
 
Securing Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the CloudSecuring Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the Cloud
 
Control Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINXControl Kubernetes Ingress and Egress Together with NGINX
Control Kubernetes Ingress and Egress Together with NGINX
 
Secured APIM-as-a-Service
Secured APIM-as-a-ServiceSecured APIM-as-a-Service
Secured APIM-as-a-Service
 
Application Security with NGINX
Application Security with NGINXApplication Security with NGINX
Application Security with NGINX
 
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
 
NGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEANGINX Basics: Ask Me Anything – EMEA
NGINX Basics: Ask Me Anything – EMEA
 
NGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJNGINX: Back to Basics – APCJ
NGINX: Back to Basics – APCJ
 
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controllerNGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
 
Fundamentals of microservices
Fundamentals of microservicesFundamentals of microservices
Fundamentals of microservices
 
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service MeshData Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh
 
Kubernetes Networking
Kubernetes NetworkingKubernetes Networking
Kubernetes Networking
 
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEAReplacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
 
How to Get Started With NGINX
How to Get Started With NGINXHow to Get Started With NGINX
How to Get Started With NGINX
 
Découvrez NGINX AppProtect
Découvrez NGINX AppProtectDécouvrez NGINX AppProtect
Découvrez NGINX AppProtect
 
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of UnitNGINX Unit at Scale: Use Cases and the Future of Unit
NGINX Unit at Scale: Use Cases and the Future of Unit
 
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
Session: A Reference Architecture for Running Modern APIs with NGINX Unit and...
 
Global Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINXGlobal Server Load Balancing with NS1 and NGINX
Global Server Load Balancing with NS1 and NGINX
 
Nim tames sprawl
Nim tames sprawlNim tames sprawl
Nim tames sprawl
 

Similar to Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP

What's New with NGINX Application Security Solutions
What's New with NGINX Application Security SolutionsWhat's New with NGINX Application Security Solutions
What's New with NGINX Application Security Solutions
NGINX, Inc.
 
Application Security with NGINX | APAC
Application Security with NGINX | APACApplication Security with NGINX | APAC
Application Security with NGINX | APAC
NGINX, Inc.
 
F5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-CloudF5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-Cloud
abenyeung1
 
Secure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINXSecure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINX
NGINX, Inc.
 
F5 Distributed Cloud.pptx
F5 Distributed Cloud.pptxF5 Distributed Cloud.pptx
F5 Distributed Cloud.pptx
abenyeung1
 
Infrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale OrganizationsInfrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale Organizations
XebiaLabs
 
Nginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lkNginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lk
Juraj Hantak
 
Deploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native KubernetesDeploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native Kubernetes
Kangaroot
 
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
VMware Tanzu
 
Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?
DevOps.com
 
F5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облакаF5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облака
BAKOTECH
 
ciscothousandeyesusecase
ciscothousandeyesusecaseciscothousandeyesusecase
ciscothousandeyesusecase
RENJITHKNAIR5
 
Automate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corpAutomate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corp
Mitchell Pronschinske
 
Successfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINXSuccessfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINX
NGINX, Inc.
 
Virtualization / Cloud / SDN
Virtualization / Cloud / SDNVirtualization / Cloud / SDN
Virtualization / Cloud / SDN
MarketingArrowECS_CZ
 
F5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 RoadshowF5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 Roadshow
patmisasi
 
VMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes ConnectVMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes Connect
VMware Tanzu
 
One And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptxOne And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptx
Avi Networks
 
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
Cisco Canada
 
Thinking about SDN and whether it is the right approach for your organization?
Thinking about SDN and whether it is the right approach for your organization?Thinking about SDN and whether it is the right approach for your organization?
Thinking about SDN and whether it is the right approach for your organization?
Cisco Canada
 

Similar to Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP (20)

What's New with NGINX Application Security Solutions
What's New with NGINX Application Security SolutionsWhat's New with NGINX Application Security Solutions
What's New with NGINX Application Security Solutions
 
Application Security with NGINX | APAC
Application Security with NGINX | APACApplication Security with NGINX | APAC
Application Security with NGINX | APAC
 
F5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-CloudF5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-Cloud
 
Secure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINXSecure Your Kubernetes Apps from Attacks with NGINX
Secure Your Kubernetes Apps from Attacks with NGINX
 
F5 Distributed Cloud.pptx
F5 Distributed Cloud.pptxF5 Distributed Cloud.pptx
F5 Distributed Cloud.pptx
 
Infrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale OrganizationsInfrastructure as Code in Large Scale Organizations
Infrastructure as Code in Large Scale Organizations
 
Nginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lkNginx app protect-for-meetup-v1.0-202006_lk
Nginx app protect-for-meetup-v1.0-202006_lk
 
Deploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native KubernetesDeploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native Kubernetes
 
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
Achieving DevSecOps Outcomes with Tanzu Advanced- May 25, 2021
 
Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?
 
F5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облакаF5 Networks - парадная дверь в облака
F5 Networks - парадная дверь в облака
 
ciscothousandeyesusecase
ciscothousandeyesusecaseciscothousandeyesusecase
ciscothousandeyesusecase
 
Automate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corpAutomate and simplify multi cloud complexity with f5 and hashi corp
Automate and simplify multi cloud complexity with f5 and hashi corp
 
Successfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINXSuccessfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINX
 
Virtualization / Cloud / SDN
Virtualization / Cloud / SDNVirtualization / Cloud / SDN
Virtualization / Cloud / SDN
 
F5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 RoadshowF5 Synthesis Toronto February 2014 Roadshow
F5 Synthesis Toronto February 2014 Roadshow
 
VMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes ConnectVMware Tanzu Kubernetes Connect
VMware Tanzu Kubernetes Connect
 
One And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptxOne And Done Multi-Cloud Load Balancing Done Right.pptx
One And Done Multi-Cloud Load Balancing Done Right.pptx
 
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
SP Virtual Managed Services (VMS) for Intelligent WAN (IWAN)
 
Thinking about SDN and whether it is the right approach for your organization?
Thinking about SDN and whether it is the right approach for your organization?Thinking about SDN and whether it is the right approach for your organization?
Thinking about SDN and whether it is the right approach for your organization?
 

Recently uploaded

Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
onemonitarsoftware
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
Task Tracker
 
ANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdfANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdf
sachin chaurasia
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
sachin chaurasia
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
karim wahed
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
Ortus Solutions, Corp
 
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdfResponsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Trackobit
 
Addressing the Top 9 User Pain Points with Visual Design Elements.pptx
Addressing the Top 9 User Pain Points with Visual Design Elements.pptxAddressing the Top 9 User Pain Points with Visual Design Elements.pptx
Addressing the Top 9 User Pain Points with Visual Design Elements.pptx
Sparity1
 
Top 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your WebsiteTop 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your Website
e-Definers Technology
 
WEBINAR SLIDES: CCX for Cloud Service Providers
WEBINAR SLIDES: CCX for Cloud Service ProvidersWEBINAR SLIDES: CCX for Cloud Service Providers
WEBINAR SLIDES: CCX for Cloud Service Providers
Severalnines
 
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
avufu
 
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple StepsSeamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
Estuary Flow
 
ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
akshesh doshi
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
VishrutGoyani1
 
dachnug51 - HCL Sametime 12 as a Software Appliance.pdf
dachnug51 - HCL Sametime 12 as a Software Appliance.pdfdachnug51 - HCL Sametime 12 as a Software Appliance.pdf
dachnug51 - HCL Sametime 12 as a Software Appliance.pdf
DNUG e.V.
 
dachnug51 - Whats new in domino 14 .pdf
dachnug51 - Whats new in domino 14  .pdfdachnug51 - Whats new in domino 14  .pdf
dachnug51 - Whats new in domino 14 .pdf
DNUG e.V.
 
Overview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptxOverview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptx
Mitchell Marsh
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdfAWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
karim wahed
 
active-directory-auditing-solution (2).pptx
active-directory-auditing-solution (2).pptxactive-directory-auditing-solution (2).pptx
active-directory-auditing-solution (2).pptx
sudsdeep
 
Safe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work PermitsSafe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work Permits
sheqnetworkmarketing
 

Recently uploaded (20)

Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
 
ANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdfANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdf
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
 
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdfResponsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
 
Addressing the Top 9 User Pain Points with Visual Design Elements.pptx
Addressing the Top 9 User Pain Points with Visual Design Elements.pptxAddressing the Top 9 User Pain Points with Visual Design Elements.pptx
Addressing the Top 9 User Pain Points with Visual Design Elements.pptx
 
Top 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your WebsiteTop 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your Website
 
WEBINAR SLIDES: CCX for Cloud Service Providers
WEBINAR SLIDES: CCX for Cloud Service ProvidersWEBINAR SLIDES: CCX for Cloud Service Providers
WEBINAR SLIDES: CCX for Cloud Service Providers
 
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
 
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple StepsSeamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
Seamless PostgreSQL to Snowflake Data Transfer in 8 Simple Steps
 
ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
 
dachnug51 - HCL Sametime 12 as a Software Appliance.pdf
dachnug51 - HCL Sametime 12 as a Software Appliance.pdfdachnug51 - HCL Sametime 12 as a Software Appliance.pdf
dachnug51 - HCL Sametime 12 as a Software Appliance.pdf
 
dachnug51 - Whats new in domino 14 .pdf
dachnug51 - Whats new in domino 14  .pdfdachnug51 - Whats new in domino 14  .pdf
dachnug51 - Whats new in domino 14 .pdf
 
Overview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptxOverview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptx
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdfAWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
 
active-directory-auditing-solution (2).pptx
active-directory-auditing-solution (2).pptxactive-directory-auditing-solution (2).pptx
active-directory-auditing-solution (2).pptx
 
Safe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work PermitsSafe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work Permits
 

Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP

  • 1. Securing Your Apps & APIs in Kubernetes VIRTUAL EVENT Aug 27th, 2020
  • 2. | ©2020 F5 NETWORKS - CONFIDENTIAL2
  • 3. | ©2020 F5 NETWORKS - CONFIDENTIAL3
  • 4. | ©2020 F5 NETWORKS - CONFIDENTIAL4
  • 5. | ©2020 F5 NETWORKS - CONFIDENTIAL5 There’s two types of apps in this world…. Greenfield Brownfield
  • 6. | ©2020 F5 NETWORKS - CONFIDENTIAL6 Ok, so maybe that’s an oversimplification…. Brownfield Greenfield
  • 7. | ©2020 F5 NETWORKS - CONFIDENTIAL7 And they often are mixed together 7 Monolithic Hybrid Microservices Modernization >60% Core, legacy business apps ~30% Legacy with micro- services add-ons ~10% Modern apps optimized for digital Statistics from 2018 NGINX Brand Survey Where most enterprises will be for years to come
  • 8. | ©2020 F5 NETWORKS - CONFIDENTIAL8 Current CNCF Landscape
  • 9. | ©2020 F5 NETWORKS - CONFIDENTIAL9 Ok, that’s a lot. What do I need to think about to start ramping towards actually getting to production? What flavor of Kubernetes am I going to leverage? Cloud Services Cloud Services Hybrids Vanilla Agnostic
  • 10. | ©2020 F5 NETWORKS - CONFIDENTIAL10 Ok, that’s still a little more complicated than expected Is there anything I can do regardless of my platform choice? Sure, and we’re about to focus on a couple of them. Figure out your application routing, monitoring, and security strategy Platform agnostic tool chain = solve the problem once, solve it for good
  • 11. | ©2020 F5 NETWORKS - CONFIDENTIAL11 Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Kubernetes adds several more locations to deploy Application Services API Gateway Load Balancer App Security Four locations to deploy Application Services: • Edge: External load balancers and proxies • Ingress Controller: Entry-point into Kubernetes • Per-Service Proxy: Interior service proxy tier • Per-Pod Proxy: Sidecar-style proxy per pod Edge
  • 12. | ©2020 F5 NETWORKS - CONFIDENTIAL12 Three criteria to determine where to deploy a service 1. Is the service specific to an application, or general, for all applications? Close to the Application Close to the Edge 3. The Technical Fit – what components offer the necessary functionality and APIs? 2. Is the service configuration owned by DevOps/DevSecOps, or by NetOps/SecOps? Owned by Dev(Sec)Ops Owned by NetOps/SecOps Not app components are equal, and different configuration and APIs meet needs of different users
  • 13. | ©2020 F5 NETWORKS - CONFIDENTIAL13 • Native open-source integration in container environments for F5 BIG-IP Ingress control • Enable self-service selection in orchestration for app services • Scale and secure apps through automated event discovery and service insertion • Scale and secure NGINX Ingress controller F5 Container Ingress Services (CIS) F5 Container Ingress Services Container Environments Visibility and Analytics F5 BIG-IP App Performance and Security Services F5 Container Ingress Services Orchestration Dotted line = integration control plane Solid line = traffic data plane AppServicesAcrossNetwork Node 2Node 1 Kubernetes Openshift
  • 14. | ©2020 F5 NETWORKS - CONFIDENTIAL14 • Single pod deployment, running in Kubernetes as nodeport • Rich, app-oriented configuration using both Kubernetes and NGINX Ingress Resources • Supports DevOps use cases: routing, B/G, circuit breaker • Multi-tenant, secure RBAC • Typically requires external LB NGINX Ingress Controller NGINX Ingress Controller Container Environments Visibility and Analytics Orchestration Dotted line = integration control plane Solid line = traffic data plane AppServicesAcrossNetwork Node 2Node 1 Kubernetes Openshift Tracing
  • 15. | ©2020 F5 NETWORKS - CONFIDENTIAL15 Ingress Controller as point of control for App Protect Ingress Controller Edge Services pod pod pod pod pod Customer DevOps requests additional capabilities using Ingress Resource extensions Kubernetes Control Plane NGINX Ingress Resource WAF policy DNS policy IPAM policy Ingress Controller automates downstream services, within boundaries controlled by NetOps Automated discovery and High-Performance Load Balancing
  • 16. | ©2020 F5 NETWORKS - CONFIDENTIAL16 WAF Deployment on the Ingress Controller DEPLOY WAF POLICIES ON THE INGRESS CONTROLLER, CONFIGURED USING KUBERNETES API Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Edge K8s NetOps/DevOps-Centric Approach Appropriate solution when WAF policies are under direction of NetOps or DevOps teams. Policies are defined and associated with services using Kubernetes API. NGINX Ingress Controller RBAC allows: • Admin users to enforce policies per listener • DevOps users to select policy per Ingress Resource Leverage Container Ingress Services to scale NGINX Ingress Controller and add other application services (LB, DNS, DDoS, IAM). Appropriate for Kubernetes-native NetOps or DevOps WAF
  • 17. NGINX App Protect CHRIS AKKER TECHNICAL SOLUTIONS ARCHITECT NGINX BU / F5
  • 18. | ©2020 F5 NETWORKS - CONFIDENTIAL18 0 2000 4000 6000 8000 10000 12000 14000 16000 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 YoY Increase in CVEs Note: Excludes any rejections or disputes. New vulnerabilities are discovered in all manner of software all the time They are exploited by both malicious bots and human attackers Do you know how many affect your application stack(s)? Can you keep up with the pace of published vulnerabilities? Do you want to?
  • 19. | ©2020 F5 NETWORKS - CONFIDENTIAL19 Strong App Security Built for Modern Apps CI/CD Friendly NGINX App Protect
  • 20. | ©2020 F5 NETWORKS - CONFIDENTIAL20 Strong App Security App security and controls built using F5 Advanced WAF technology. Blocks attacks and helps prevent downtime. Easy Install & Updates OWASP Top 10 And More Regulatory Compliance IP Blocking Prevent sensitive data loss F5-based Layer 7 Attack Protection API Security
  • 21. | ©2020 F5 NETWORKS - CONFIDENTIAL21 Built for Modern Apps High performance security with performance and scale Small Footprint, less than 2MB on disk – ideal for Container workloads Seamless integration into the #1 web application platform High performance Deployment options Minimizes tool sprawl Lightweight footprint Seamless NGINX Integration 20X+ faster than alternative OSS
  • 22. | ©2020 F5 NETWORKS - CONFIDENTIAL22 CI/CD Friendly Enable security to keep pace with DevOps and Support “shift left” initiatives Declarative policies Speed Time to Market Reduced cost Enable AppDev Feedback loops Automate security in CI/CD cycle
  • 23. | ©2020 F5 NETWORKS - CONFIDENTIAL23 CONFIDENTIAL Signature Differences Attack Signature Threat Campaign Generic form of attack Instance of a specific attack Many false positives Near 100% accurate Difficult to evade Sensitive to attack variations Updated once in couple of weeks Multiple updates per week No information if ever exploited Based on real observations Generic attack information Provides Context (Intent/Risk) Local attack indicator Global threat visibility ~4,000 ~200
  • 24. | ©2020 F5 NETWORKS - CONFIDENTIAL24 Deployment options / Use Cases  Edge SW WAF  API WAF  Kubernetes IC WAF  Pod WAF  Microservice WAF
  • 25. | ©2020 F5 NETWORKS - CONFIDENTIAL25 Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Kubernetes adds several more locations to deploy Application Security API Gateway Load Balancer App Security Four locations to deploy Application Services: • Edge: External load balancers and proxies • Ingress Controller: Entry-point into Kubernetes • Per-Service Proxy: Interior service proxy tier • Per-Pod Proxy: Proxy embedded in pod Edge Standard App Protect NGINX-Proxy deployment
  • 26. | ©2020 F5 NETWORKS - CONFIDENTIAL26 Declarative Policy Helps CI/CD Motion INFRASTRUCTURE AND SECURITY AS CODE Source Code Repository CI/CD Pipeline Tool IT Automation Application code/config for App X security policy/config for App X Pipeline for build/test/deploy of App X Ansible playbook for deployment of App X with its app services Owned by SecOps Operated by DevOps { "entityChanges": { "type": "explicit" }, "entity": { "name": "bak" }, "entityKind": "tm:asm:policies:filetypes:filetypestate", "action": "delete", "description": "Delete Disallowed File Type" }
  • 27. Demo Highlights ENVIRONMENT OVERVIEW NGINX PLUS WITH APP PROTECT - EDGE NGINX PLUS KUBERNETES INGRESS WITH APP PROTECT ELK – KIBANA DASHBOARDS EXAMPLE
  • 28. 357 Demo 3 INSTALL COMMANDS 5 LINES OF CONFIGURATION 7 MINUTES TO RUNNING APP PROTECT
  • 30. | ©2020 F5 NETWORKS - CONFIDENTIAL30 Centos# yum install –y app-protect Centos# yum install –y app-protect-attack-signatures Centos# yum install –y app-protect-threat-campaigns 3 - Install AppProtect on Centos 7 Pre-Reqs 1. Need your NginxPlus Repo SSL nginx.crt and nginx.key 2. Add the App-Protect Signatures yum repo Centos# wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-signatures-7.repo
  • 31. | ©2020 F5 NETWORKS - CONFIDENTIAL31 user nginx; worker_processes auto; error_log /var/log/nginx/error.log notice; pid /var/run/nginx.pid; load_module modules/ngx_http_app_protect_module.so; #Dynamic Module … server { listen 80; server_name localhost; proxy_http_version 1.1; app_protect_enable on; #Enable AppProtect app_protect_policy_file "/etc/nginx/NginxDefaultPolicy.json"; #Policy Definition app_protect_security_log_enable on; #Enable logging app_protect_security_log "/etc/nginx/log-default.json” syslog:server=10.1.20.6:5144; #Syslog IP:port location / { … proxy_pass http://k8s.arcadia-finance.io:30274$request_uri; } } 5 – Configure Nginx.conf with AppProtect
  • 32. | ©2020 F5 NETWORKS - CONFIDENTIAL32 Centos# systemctl restart nginx Centos# cat /var/log/nginx/error.log Centos# curl –k http://localhost Centos# curl –k “http://localhost/?<script>” 7 – Running NginxPlus with AppProtect
  • 33. | ©2020 F5 NETWORKS - CONFIDENTIAL33 Demo Ingress YAML with App Protect
  • 34. NGINX App Protect WRAP UP SIZE ? PERFORMANCE ? RESOURCES
  • 35. | ©2020 F5 NETWORKS - CONFIDENTIAL35 Yum info app-protect Name : app-protect Arch : x86_64 Version : 22+3.90.2 Release : 1.el7.ngx Size : 172 k Repo : installed From repo : nginx-plus App Protect Repo
  • 36. | ©2020 F5 NETWORKS - CONFIDENTIAL36 Yum info app-protect-attack-signatures Name : app-protect-attack-signatures Arch : x86_64 Version : 2020.08.19 Release : 1.el7.ngx Size : 1.3 M Repo : installed From repo : app-protect-signatures Summary : app-protect-attack-signatures-rpm License : Commercial App Protect Signatures Repo
  • 37. | ©2020 F5 NETWORKS - CONFIDENTIAL37 Yum info app-protect-threat-campaigns Name : app-protect-threat-campaigns Arch : x86_64 Version : 2020.08.24 Release : 1.el7.ngx Size : 113 k Repo : installed From repo : app-protect-signatures Summary : app-protect-threat-campaigns-rpm License : Commercial Threat Campaign Repo
  • 38. | ©2020 F5 NETWORKS - CONFIDENTIAL38 NGINX App Protect Performance 0 0.5 1 1.5 2 2.5 Throughput (MB/sec) No Protection NGINX App Protect ModSec 0 2000 4000 6000 8000 10000 12000 14000 Requests/sec No Protection NGINX App Protect ModSec 0 100 200 300 400 500 600 700 800 Latency (ms) No Protection NGINX App Protect ModSec Comprehensive security policy has no impact on latency, and offers better throughput and requests/second when compared to ModSec • ModSec Configuration: OWASP Top 10 (enable all CRS v3 rules) • NGINX App Protect Configuration: OWASP Top 10 (Enable signatures), Evasion technique, Data Guard, Disallowed file types, HTTP protocol compliance​
  • 39. | ©2020 F5 NETWORKS - CONFIDENTIAL39 Nginx App Protect Resources ● https://www.nginx.com/products/nginx-app-protect/ ● https://docs.nginx.com/nginx-app-protect/admin-guide/# ● https://www.nginx.com/blog/nginx-app-protect-1-0-released/ Nginx Threat Campaigns ● https://www.f5.com/pdf/products/f5_threat_campaigns_waf.pdf NGINX Ingress Controller with App Protect ● https://www.nginx.com/blog/securing-apps-in-kubernetes-nginx-app-protect/ ● https://github.com/nginxinc/kubernetes-ingress/tree/master/examples/appprotect ● https://github.com/nginxinc/ansible-role-nginx-app-protect Resources
  • 40. | ©2020 F5 NETWORKS - CONFIDENTIAL40 Questions?
  • 41. | ©2020 F541 September 15-17, 2020 VIRTUAL EVENT Sprint is a three-day virtual event designed to inspire and engage developers, architects, and operators looking to use NGINX technologies to develop and deliver modern applications at scale. www.nginx.com/events/nginx-sprint-2020 GOALS • Introduce solutions and evolution of NGINX. • Engage with the NGINX community and users. • Attract 1,500 live attendees/day.
  • 42. | ©2020 F542 Day One: Keynotes SEPTEMBER 15 Duration: 2 hours Pre-recorded and streamed “live” • Provide thought leadership, roadmap review, and announce new solutions • Invite external influencers and maybe customers to present • Engage audience with post-keynote analysis from Tech Field Day Day Two: Demos SEPTEMBER 16 Duration: 1.5 hours Live, interactive session • Provide 6-7 short demos showing of NGINX and F5 products • Have demos build on each other, creating a single app by the end • Use delegates from Tech Field Day as audience proxy Day Three: Hackathon SEPTEMBER 17 Duration: 2-3 hours Live streamed session • Have teams present ideas and prototypes • Judge and award winners
  • 43. | ©2020 F5 NETWORKS - CONFIDENTIAL43 Thank You!
  • 45. | ©2020 F5 NETWORKS - CONFIDENTIAL45
  • 46. | ©2020 F5 NETWORKS - CONFIDENTIAL46 Kibana Overview page
  • 47. | ©2020 F5 NETWORKS - CONFIDENTIAL47 Kibana Log Entry details
  • 48. | ©2020 F5 NETWORKS - CONFIDENTIAL48
  • 49. | ©2020 F5 NETWORKS - CONFIDENTIAL49
  • 50. | ©2020 F5 NETWORKS - CONFIDENTIAL50 Arcadia Ingress