Achieving DevSecOps Outcomes with Tanzu Advanced- March 22, 2021
•Télécharger en tant que PPTX, PDF•
0 j'aime•1,835 vues
Presentation slides from Achieving DevSecOps Outcomes with Tanzu Advanced - March 22, 2021
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Achieving DevSecOps Outcomes with Tanzu Advanced- March 22, 2021
Similaire à Achieving DevSecOps Outcomes with Tanzu Advanced- March 22, 2021 (20)
Plus de VMware Tanzu
Plus de VMware Tanzu (20)
Dernier
Dernier (20)
Achieving DevSecOps Outcomes with Tanzu Advanced- March 22, 2021
- 1. Confidential │ ©2020 VMware, Inc. Achieving DevSecOps Outcomes with Tanzu Advanced David M. Zendzian (dmz) Global Field CISO, VMware Tanzu James Urquhart Strategic Executive Advisor VMware Tanzu Chris DeLashmutt Principal Solutions Engineer VMware Tanzu
- 2. Confidential │ ©2020 VMware, Inc. 2 Build or Acquire Software and the Hardware Required to Run It The Traditional Role of IT Applications Infrastructure
- 3. Confidential │ ©2020 VMware, Inc. 3 Deliver better software to production, faster Structured Around Critical Capabilities Applications Infrastructure DEVELOPER EXPERIENCE OPERATOR EXPERIENCE Code and containerize custom applications Reduce risk with curated build packs and services Automate deployment of apps into production Enable developer self- service with K8s across clouds, clusters and teams Apply enterprise observability to drive decisions and reduce risk Ensure secure and reliable communication between services Multi-cloud
- 4. Confidential │ ©2020 VMware, Inc. 4 Deliver better software to production faster with less risk Modern Application Demands Change The Conversation Applications Infrastructure LOW TOIL, LOW RISK PATH TO PRODUCTION LOW TOIL, LOW RISK SERVICE DELIVERY Multi-cloud
- 5. Confidential │ ©2020 VMware, Inc. Creation (coding, sourcing, unit testing, dev local workspace) Build/Verify (CI, build, integration testing, registry, security scanning, etc) Deploy/Operate (CD, configuration, automation, load/stress testing) Connect (Networking, load balancing, ingress/egress, etc.) Observe (K8S, compute, network, storage, self-service) Five areas of focus for DevSecOps
- 6. Confidential │ ©2020 VMware, Inc. 7 DevSecOps Capabilities – Build, Run, Manage The Right Tools, The Right Parts Modern businesses operate in a regulated world; it is only when internal policy, governance and audit teams partner with developers that they can fully meet these regulations.
- 7. Confidential │ ©2020 VMware, Inc. 8 DevSecOps Capabilities – Create The Right Tools, The Right Parts Developers should focus on building great software, not achieving basic security for well- known architectures.
- 8. Confidential │ ©2020 VMware, Inc. 9 Development environment • Tools • Databases • Services • Kubernetes CODE DevSecOps Flow – Create Version Control Includes: • Developer’s local development environment • IDEs and editors • Debugging tools • Docker/containerd • Application Stack • Frameworks • Libraries • Middleware/Runtime • Required shared services • Databases and file stores • Message/event queues • Cloud services • Version Control
- 9. “In order to do all these things that would keep you ahead of the curve, you need to have agility, you need to be able to kind of dream something in the morning and deliver them by evening.” Confidential │ ©2020 VMware, Inc. VIRAJ NAIK Lead Solutions Architect, Travelers Insurance Confidential │ ©2021 VMware, Inc.
- 10. Confidential │ ©2020 VMware, Inc. 11 DevSecOps Capabilities – Build/Verify The Right Tools, The Right Parts Bulding, testing, and packaging distributed applications requires a trusted supply- chain, verification of build integrity, and ensuring the immutability of delivered containers.
- 11. Confidential │ ©2020 VMware, Inc. 12 Automated container packaging • Validated • Reproducible builds • Security and patching CI Container image registry • Secure artifacts with policies and role-based access • Image scanning and signing DevSecOps Flow – Build/Verify Version Control Includes: • Cloud Native Build Packs • Curated/Validated • CVE and Bug Mitigations • Upstream • Automated Builds
- 12. “Scanned and verified ‘golden images’ are the bedrock of your container security.” Confidential │ ©2020 VMware, Inc. FORRESTER RESEARCH "Best Practices For Container Security," July 2020 Confidential │ ©2021 VMware, Inc.
- 13. Confidential │ ©2020 VMware, Inc. 14 DevSecOps Capabilities – Deploy/Operate The Right Tools, The Right Parts Running custom software securely is not the act of a single organization or a single toolset. Intrinsic security is only achieved by an intentional coordination of security concerns, both between dependencies and up and down the stack.
- 14. Confidential │ ©2020 VMware, Inc. 15 Container image registry • Secure artifacts with policies and role-based access • Image scanning and signing CD CUSTOMER Validated catalog of runtimes and images • Curated, secure, validated OSS images DevSecOps Flow – Deploy/Operate Open source aligned Kubernetes • Certified, conformant Kubernetes runtime • Cluster-API-driven lifecycle management Centralized management for multiple clusters across clouds • Policy management, enforcement • Identity and access management • Backup and restore
- 15. Confidential │ ©2020 VMware, Inc. 16 “By 2025, more than 85% of global organizations will be running containerized applications in production, which is a significant increase from fewer than 35% in 2019.” Confidential │ ©2020 VMware, Inc. GARTNER “Best Practices for Running Containers and Kubernetes in Production,” Published 4 August 2020 Confidential │ ©2021 VMware, Inc.
- 16. Confidential │ ©2020 VMware, Inc. 18 DevSecOps Capabilities – Connect/Observe The Right Tools, The Right Parts Managing (and securing) a complex systems portfolio requires being able to see the system and both its intended and emergent behaviors.
- 17. Confidential │ ©2020 VMware, Inc. 19 CUSTOMER DevSecOps Flow – Connect Open source aligned Kubernetes • Certified, conformant Kubernetes runtime • Cluster-API-driven lifecycle management Centralized management for multiple clusters across clouds • Policy management, enforcement • Identity and access management • Backup and restore Connect and protect applications • Encrypted traffic, security policies, firewall
- 18. Confidential │ ©2020 VMware, Inc. 21 CUSTOMER DevSecOps Flow – Observe Open source aligned Kubernetes • Certified, conformant Kubernetes runtime • Cluster-API-driven lifecycle management Centralized management for multiple clusters across clouds • Policy management, enforcement • Identity and access management • Backup and restore Observability • Visibility across applications, clusters based on open standards Connect and protect applications • Encrypted traffic, security policies, firewall
- 19. Confidential │ ©2020 VMware, Inc. 23 Container image registry • Secure artifacts with policies and role-based access • Image scanning and signing Observability • Visibility across applications, clusters based on open standards Connect and protect applications • Encrypted traffic, security policies, firewall CD Development environment • Tools • Databases • Services • Kubernetes CODE CUSTOMER Automated container packaging • Validated • Reproducible builds • Security and patching CI Open source aligned Kubernetes • Certified, conformant Kubernetes runtime • Cluster-API-driven lifecycle management Centralized management for multiple clusters across clouds • Policy management, enforcement • Identity and access management • Backup and restore Validated catalog of runtimes and images • Curated, secure, validated OSS images DevSecOps Flow Version Control
- 20. Confidential │ ©2020 VMware, Inc. 24 VMware Tanzu Advanced Benefits New K8s, same UI Adopt Kubernetes with no additional code or training required Multi-cloud simplified Operate VMs and containers side-by- side with a global control plane Platform Development Drive cloud native architecture Consistent policy Access, back up, controls etc. across all clusters for DevSecOps Cloud native constructs Drive adoption of microservices, containers, and data models App Navigator Drive cloud native patterns Intrinsic security for apps App security part of software development lifecycle Accelerate developer velocity Enable self-service and automate the path to production Application Modernization Catalyst for customer outcomes OPS: Embrace move to containers and K8s Simplify operation across multi-cloud SEC: Secure containers and open source Reduce risk across app portfolio DEV: Deliver apps and updates faster Re-platform or re-factor app-by-app Architect: Enable agile business through software Eliminate friction of Dev, Sec, and Ops
Notes de l'éditeur
- So what?
- So what?
- So what?
- Forrester shares that a best practice in container security is having scanned and verified golden images. It’s about having a solid foundation of what is supported, and knowing what is in your containers.
- Forrester shares that a best practice in container security is having scanned and verified golden images. It’s about having a solid foundation of what is supported, and knowing what is in your containers.
- And there's going to be growing pressure to graduate from the playground sooner than later. If 2020 showed us nothing else, it was the importance of being able to move quickly to address customer needs and solve real business problems. Many companies were caught on their back foot with heritage applications and monolithic processes, unable to respond to the moment. But if Gartner's prediction is true, 85% of global organizations will be running containerized applications in production by 2025 — a significant increase from 35% in 2019.
- And there's going to be growing pressure to graduate from the playground sooner than later. If 2020 showed us nothing else, it was the importance of being able to move quickly to address customer needs and solve real business problems. Many companies were caught on their back foot with heritage applications and monolithic processes, unable to respond to the moment. But if Gartner's prediction is true, 85% of global organizations will be running containerized applications in production by 2025 — a significant increase from 35% in 2019.
- And there's going to be growing pressure to graduate from the playground sooner than later. If 2020 showed us nothing else, it was the importance of being able to move quickly to address customer needs and solve real business problems. Many companies were caught on their back foot with heritage applications and monolithic processes, unable to respond to the moment. But if Gartner's prediction is true, 85% of global organizations will be running containerized applications in production by 2025 — a significant increase from 35% in 2019.
- Now it’s time to recap the benefits of Tanzu Advanced for your organization. From the operations side, you can benefit from that consistency of Kubernetes distribution and management. You can simplify your multi-cloud and hybrid cloud operation and manage policy centrally and effectively. From an application development side, developers can use the frameworks and tools that they prefer and plug into an automated, secure software supply chain to deliver their application to production. Self service vs. friction. Tanzu Advanced enables that shift-left of security so that containers are secure by design and continuously maintained. You can see how Tanzu Advanced brings these teams together to speed the delivery of modern apps securely and at scale. And Tanzu Labs can help you pull all of this together to help you build the platform that’s right for your organization and modernize your applications. And along the way, they can help you adopt a DevSecOps approach to software development and delivery.