Latest release builds on current Kubernetes capabilities to enhance security, further deepening Aqua’s cross-platform support for cloud-native application security
Boston, MA – 7 March 2018 – Aqua Security, the market-leading platform provider for securing container-based and cloud-native applications, today announced the availability of version 3.0 of its platform featuring new security automation and controls for Kubernetes-based runtime environments. The new release also introduces more than 120 additional features, extending the capabilities of the company’s end-to-end container security platform to address the requirements of today’s multi-platform enterprise customers, from securing the build pipeline and enabling DevSecOps, to runtime protection of workloads. As part of its 3.0 launch, Aqua also unveiled patent-pending MicroEnforcer™ architecture to deliver runtime security for Container-as-a-Service environments – see companion announcement here for more details.
“Kubernetes adoption has been increasing along with the maturity and enterprise-readiness of its features” noted Liz Rice, Technology Evangelist at Aqua Security. “With the enterprise security skill shortage, enterprises are looking for ways to leverage Kubernetes to automate deployments and accelerate application delivery, at scale, without compromising on security. That’s what Aqua 3.0 is all about”.
Aqua 3.0 builds on Kubernetes security capabilities to provide automated Kubernetes-native controls in several key areas:
- Kubernetes-Native Role Based Access Controls: Aqua 3.0 enables customers to leverage Kubernetes webhook admission controller to create fine-grained user access control roles and policies, controlling access to kubectl commands, governed by Aqua’s scalable labeling scheme. This enables security teams to govern access across teams, with full segregation of duties.
- Kubernetes-Native Image Assurance Controls: In addition to its ability to block unapproved images from running at the individual host level, Aqua can now prevent Kubernetes from running unapproved images across entire clusters, providing a more efficient mechanism that scales across large deployments.
-
Kubernetes-Native Network Controls: Aqua’s container-level firewall now enables admins to control network traffic based on Kubernetes namespaces, clusters or deployments. This allows admins to enforce network segmentation for compliance purposes, as well as limit an attack’s “blast radius” across clusters and applications.
- CIS Kubernetes Benchmark: Building upon Aqua’s open-source Kube-Bench, the tool widely used by the community to validate the security posture of Kubernetes deployments, Aqua now incorporates CIS Kubernetes benchmark checks alongside updated Docker CIS benchmark checks. Automated checks can run daily, providing a detailed report that can also be exported for compliance.
- Kubernetes Context in Audit Events: Aqua’s event logging now includes Kubernetes-specific information, such as pod name, type, deployment and namespace data, providing additional visibility for compliance and forensics.
Aqua’s platform is currently in use by dozens of Global 1000 customers, providing the most comprehensive full-lifecycle solution for securing container-based and cloud-native applications, running on-prem or in the cloud, supporting both Linux and Windows runtime environments. The Aqua platform drives DevSecOps automation, and provides visibility and runtime protection for cloud-native workloads, including both host-level and network-level controls.
Aqua 3.0 is compatible with implementations of Kubernetes 1.8 or newer, and is available to existing Aqua customers. It is certified on popular Kubernetes-based deployments, including Azure AKS and ACS, Google GKE, Amazon EKS, and Red Hat OpenShift, and is a Kubernetes Technology Partner. For additional information:
- Blog: Aqua 3.0 – Kubernetes Security Deep-Dive
- Aqua’s Kubernetes Security page
- Live webinar – March 14th: Securing Kubernetes at Scale
Aqua 3.0 also introduces many other new features, including malware scanning for images and hosts, vulnerability scanning for hosts, and enhanced support for network plug-ins Flannel, Calico, Weave and Contiv. Additionally with version 3.0, Aqua unveils its patent-pending MicroEnforcer technology for securing “zero infrastructure” container-as-a-service offerings – see our companion announcement here.
