KubeCon
+ CloudNativeCon 2021. Will you be in attendance? If so, VMblog
invites you to swing by and check out the Deepfence booth in the sponsor
showcase.
Read this exclusive KubeCon pre-show interview
between VMblog and Sandeep Lahane, Founder and CEO of Deepfence. Today's DevSecOps teams need comprehensive visibility into their dynamic applications and infrastructure. Deepfence ThreatMapper auto-discovers your production infrastructure. It identifies and interrogates cloud instances, Kubernetes nodes, and serverless resources, discovering the applications and containers and mapping their topology in real time.

VMblog:
As a KubeCon 2021 sponsor, how excited is your company to be back at an
in-person trade show event? And is your team prepared for what's to come? Do
you anticipate any challenges?
Sandeep Lahane: Super excited! In
fact, this is our first major in-person event this year, and it's great to be
able to meet friends, colleagues and members of the community face-to-face at
last. Some of the Deepfence team will be at KubeCon, some can't make it as
there are still travel restrictions and we have a global team. We'll lean on
the ‘virtual meeting' services that the KubeCon team are offering, hoping that
they will scale and remain secure, and I expect that a lot of events over the
next 12 months are going to be mostly virtual.
VMblog:
How can people find you at the show this year? Can you give VMblog readers a
sneak peek as to what you will be showing off at your booth? What should
attendees expect to see and hear at your booth?
Lahane: Come and find us at booth S56, close to some
of the foot and rest areas, and we'll be happy to share with you what we are
announcing.
Deepfence monitors the security of
applications running in production and we will be sharing exciting news around our
products on Wednesday at the show. Shift-Left initiatives do a great job of
securing build artifacts before they go into production, but once they are
running, that's when Shift-Left tooling hands off the baton to Deepfence. We'll
show attendees how to visualize their apps in production, check running
workloads for vulnerabilities, rank these by ‘risk of exploit' based on the
runtime context and tell you what you need to fix first.
VMblog:
Attendees always enjoy a good trade show tchotchke. Are you giving away any
prizes at your booth or participating in any prize giveaways?
Lahane: Yes! we're offering
our Beats by Dre Giveaway. Every KubeCon + CloudNativeCon North America 2021
attendee who visits the Deepfence booth virtually or in person (booth S56) will
be entered into the drawing for a chance to win Beats Studio Buds. We'll be
giving away not one, but THREE, Beats Studio Buds in our giveaway. So be sure
to meet us at the event, virtually or in person, for your chance to win.
VMblog:
Have you sponsored KubeCon in the past? If so, what is it about this show that
keeps you coming back as a sponsor?
Lahane: We're coming very much as a startup to
KubeCon, although the technology we're showcasing is proven and running in
production with a number of customers and community deployments. Announcing the
next evolution of our offerings has brought us here to KubeCon.
VMblog:
What do you attribute to the success and growth of this industry and the
KubeCon event itself?
Lahane: The CNCF is taking a strong leadership role to
guide the industry in how to adopt and use some frankly complicated and fragile
technology. The ecosystem around Kubernetes is huge, and necessarily so, and
KubeCon is a great event for users, the community, and for vendors to get
together and share best practices and tales from the coal face.
The KubeCon team tread a fine line between the
vendors who sponsor the event and users who are looking for predominantly
open-source solutions, always leaning on the side of "what is right for the
community." This has kept KubeCon to be an open, non-partisan event each year,
and that's what ensures its long-term success.
VMblog:
What are you most interested in hearing about at this year's KubeCon event?
Lahane: At Deepfence, we have an interest in learning
what is happening in the community around security, from the dual perspectives
of developers who are charged with delivering secure code and artifacts, and
operators who are charged with managing the ongoing security of their runtime
platforms. We want to learn what is happening in the community, and how we can
support those initiatives with our runtime security observability platform.
VMblog:
What are some of the reasons why you believe a KubeCon attendee should add you
to their MUST SEE list?
Lahane: Security is of course top-of-mind for
developers and operators. There's lots of innovation in shift-left
developer-focused solutions, and there's lots of good things happening to help
people monitor and secure their platforms, with compliance tooling and
infrastructure-as-code initiatives. However, there's no good solution that
focuses on run-time security of the workloads. What currently exists is either
too low-level, needing a lot of expertise to operate it effectively, or limited
to very specific techniques.
We address this need. Deepfence operates a set
of techniques that we feel are essential for any runtime platform to monitor
the security of workloads against emerging threats and monitor the behavior of
users to identify emerging attacks. We do all of this without any changes to
the platform or the application. If you're intrigued, come and visit us to find
out more.
VMblog:
How does your company or product fit within the container, cloud, Kubernetes
ecosystem?
Lahane: See above. Essentially, we look at cloud as a
continuum where different cloud native modalities exist side by side. For
example, we very often see a mix of kubernetes and virtual machine or
serverless based workloads side by side, Deepfence provides security observability
across the entire continuum of cloud native modalities.
Deepfence offerings are easy to install into an existing Kubernetes or Docker
runtime environment, and we support multi-cloud deployments with ease. You can
also, with a small amount of additional work, observe and secure AWS Fargate
and bare metal or VM environments too.
VMblog: Can you give readers a few examples of
how your offerings are unique? What are your differentiators?
Lahane: There are a couple of things that we do that
we believe are genuinely unique in the industry.
We take the good processes and practices that
developers use during shift-left to scan build artifacts for known
vulnerabilities, and we apply those to production. We scan running, stopped and
in-registry containers, hosts and applications for known vulnerabilities,
picking up where Shift Left stops. This is vital because not every production
workload goes through a shift-left process, and vulnerabilities can be
discovered and published once an application is built, but while it's running
in production.
While scanning runtime artifacts, we observe
network traffic packages and dependencies which are loaded in memory at
runtime, and deduce potential attack paths, this is not possible in CI/CD
process as the runtime context is not available at that time. With this runtime
context, we can then let the admin know which are the most exploitable
vulnerabilities, and what is the potential exploit path. This ‘threat map' is
key to how users benefit from our product.
The second thing we do is to gather runtime
signals and telemetry to deduce what is happening in your applications, and to
seek out anomalies that might indicate that something unusual is happening. There
are a number of projects that gather on-host and in-container telemetry using
eBPF and file monitoring to identify possible ‘indicators of compromise' on the
application. These "indicators-of-compromise" on their own are generally too
late, and often collected post facto. Uniquely, we sample network traffic, at
layer 7 and decrypting TLS, so that we capture network transactions. We then
match these transactions against threat feeds, and by doing so, we can see
ongoing recon traffic, successful exploits, command and control, and
exfiltration events. These are "indicators of attack," and they are both
precursors to an attack and provide essential context to help administrators
understand security events and attacks as they unfold.
VMblog:
If an attendee likes what they see and hear at your booth, what message about
your product can you send them back with to sell their boss on your technology?
Lahane: We've invested in "shift left" and seen huge
security benefits there, but we can't afford to forget about production. Shift
left stops once the app is in production. Deepfence picks up where Shift Left
finishes, and scans for threats in production, and it does so with minimal
impact on our production platform. We need to talk to the Deepfence team to
learn how to take advantage of it!
##