2435 - 在 IBM Cloud Kubernetes 服务上使用数百个容器进行攻击面管理.pdf

1、1Attack Surface Management with Hundreds of Containers on IBM Cloud Kubernetes ServiceSMS DataTechSenior Technical Security AnalystYuki Hanamura2Agenda1.About us2.What is ASM?3.Sequence of ASM Scan4.Demo3About us4Predictfuture threats and Protectthe future of organizationYuki HanamuraSenior Technica

2、l Security Analyst5Our Evaluationin the security fieldTV appearanceas a data breach expertDX Challenge Japan 2022Best Technology AwardDX Challenge Japan 2023Grand PrizeOur ProductMonitoring and visualizing corporate information leaks on the dark webAchieving integrated monitoring of data leaks and a

3、ttack surfaces.Data BreachAttack SurfaceWhat is Attack Surface?With the spread of remote work,the attack surface has rapidly expanded in recent years.Before(Pre-COVID-19)Now(Post-COVID-19)9What is ASM?10AttackSurfaceManagementWhat is ASM?The continuous process of identifying,monitoring,and reducing

4、risksacross all IT assets that are visible from the outside.12Sequence of ASM ScanSequence of ASM Scan1234Top Domain InputDetect subdomains based on the top domain nameJob QueueRedis receives and queues scanning tasks for distributed processingScan ExecutionThe tasks that were placed in the Redis qu

5、eue are now taken out by the consumers.Dynamic ScalingKEDA monitors queue depth and scales scanner pods on IBM Cloud Kubernetes ServiceDetect subdomains and IP addresses based on the top domain name.1.Top Domain InputDetected Subdomains and IP Customers Top Domain Inputscan4.Scaling3.Execution2.Queu

6、e1.ISubdomains1.1.1.12.2.2.23.3.3.34.4.4.45.5.5.5IP addresses4.ScalingDjango sends scanning tasks to Redis,which receives and queues these tasks for distributed processing.2.Job Queue3.Execution2.Queue1.InputScan Targetssend tasksProducerQ1.1.1.12.2.2.23.3.3.3ApplicationsSoftware