Safe landing practice of software supply chain under salesforce containerized ISV scenario

With the enterprise  IT  The evolution process of digital transformation , More and more enterprises adopt the cloud original biochemical architecture upgrade method , Improve the efficiency of application development, operation and maintenance iteration , Accelerate the iteration of enterprise business innovation , Improve the efficiency of resource elastic management and migration , Help enterprises reduce costs and increase efficiency . But because of the cloud's native elasticity 、 Agility and dynamic extensibility , It also introduces new challenges to cloud native software supply chain security .

Salesforce  It was created in  1999  year  3  A customer relationship management company in January  (CRM)  Software service provider , Customer relationship management platform for on-demand applications .Salesforce  Allows customers to customize and integrate their products with independent software vendors , At the same time, they need to build their own applications . With the trend of social e-commerce sweeping the world ,2022  year  1  month ,Salesforcs  Jointly released software for the Chinese market with Alibaba cloud “Salesforce  Social electricity ”, This is a  Salesforce  After reaching strategic cooperation with Alibaba cloud, it will launch new products in the Chinese market . The software is hosted by Alibaba cloud  Headless  E-commerce midrange products , Can manage and unify the enterprise in  Web  Website 、 Move  App  And e-commerce applications through various channels such as small programs , To get the customer's  360  Degree view , So as to improve the customer experience and promote business growth .

Containerization  ISV  Security challenges for delivery

In the process of containerized delivery transformation , With  Salesforce  Container software for example  ISV, It is necessary to solve the complexity of the environment in the cloud native scene 、 Software supply chain risk challenges from diversification . In order to ensure that the software is developed 、 Smooth progress from delivery to operation , The whole software supply chain life cycle should be based on ensuring software availability 、 integrity 、 On the basis of confidentiality , Reduce the security risk of software supply chain , Achieve full link auditability , Traceability , It can automate safe operation . In order to achieve such a requirement  , The following challenges are mainly faced in the process of containerization delivery and transformation ：

• Third party and open source components bring security risks ： Enterprise software projects tend to rely more and more on components from the vendor tripartite or open source community , These components are often transferred in the software supply chain in the form of basic images . An attacker may exploit a vulnerability in the component , Inject malicious code or control the third-party machine environment , Perform mining from cryptocurrency 、 spam 、 To launch through a large botnet  DDoS  attack .

• The long link of software delivery buries more risks ： From the demand analysis of software development stage 、 Code development 、 Integrate 、 test , To  ISV  Channel specific software delivery in the delivery phase 、 End customer acceptance , The end-user software in the final running phase runs 、 Operation and maintenance . The whole software supply chain has a long cycle , There may be safety risks in all links , Lead to software vulnerabilities 、 Software backdoor 、 Malicious tampering 、 Intellectual property risk 、 Information leakage and other security threats .

• Containerized operation introduces more risk attack surfaces ： Container application deployment depends on  Linux  The kernel feature , Many hackers exploit kernel system vulnerabilities , Launch targeted escape or intrusion attacks from multiple dimensions such as container runtime components and container application deployment configuration . Recent years  K8s、Docker、Istio  And other open source communities have exposed many high-risk vulnerabilities , This provides an opportunity for the attacker .

The whole software supply chain life cycle should be based on ensuring software availability 、 integrity 、 On the basis of confidentiality , Reduce the security risk of software supply chain , Achieve full link auditability , Traceability , It can automate safe operation . Guarantee from software development 、 Deliver to run , The whole software supply chain has the security capability of defense in depth , If anything goes wrong , It can timely and accurately locate and trace problems , Identify the risks of interested parties and reinforce them safely in time .

Alibaba cloud native software supply chain solution

In order to help customers practice software supply chain security more conveniently , The Alibaba cloud container service team provides end-to-end solutions . Enterprise customers can develop iteration scenarios in cross enterprise delivery or within the enterprise , Improve safety management efficiency and safety reinforcement ability , Implement secure and trusted delivery of full link container applications .

（ Containerization  ISV  Delivery scenarios ）

In the container application delivery phase , Container image service  ACR   Enterprise Edition provides cloud native application delivery chain capability , Converged access control 、 Mirror construction 、 Content security 、 Binary authentication 、 Global distribution and other capabilities , Support preset risk interception strategies , Discover and stop 、 The safety control moves to the left .

• Image content security ,ACR  It provides an enhanced container image scanning engine jointly with the cloud security center , Cover system vulnerabilities 、 Application vulnerability 、 Risk types such as baseline inspection and malicious samples , High recognition rate 、 Low false positive rate vulnerability scanning capability . meanwhile , Provides container image repair capability , Support automated and efficient repair of risk vulnerabilities , Realize the security closed loop from discovery to repair .

• Image cross account delivery , For inter enterprise  ISV  Application delivery scenarios ,ACR  Cross account synchronization capability is provided to ensure the distribution security of container image and signature .ISV  Pass the image and the corresponding signature information through  ACR  Cross account synchronization capability is delivered to  ISV  Customer instance of . The corresponding image turns on the immutable image version , Ensure that the version of the image cannot be overwritten .ISV  Our customers are  ACK  When deploying images on , Will be based on  ISV  Public key signature verification , Ensure that the image is complete and from  ISV.

In the running phase of container application , Container services  ACK  In the default control component 、 System components are securely secured , Provides deployment policy management 、 Safety inspection , Security policies that guarantee the consistency of container applications .ACK  The integrated cloud security center provides container runtime security monitoring and alarm capabilities , Cover  ATT&CK  Killing chain  200  The remainder of the security detection model , Improve the security of the overall business load operating environment . be based on  ISV  Application running scenarios ,ACK  A secure sandbox container is also provided as a runtime solution , Ensure better safety isolation capability and higher stability .

• Deploy policy management ：ACK  be based on  OPA  Policy engine and rich preset policy templates , Effective constraint application configuration security , Support container business  YAML  Multi dimensional deployment policy management , Avoid privilege containers 、 Risk image deployment and other risk behaviors , Strengthen the active management capability of container security on the cluster side .

• Safe sandbox container ： The end customer uses a secure sandbox container as the runtime , Compared with the original  Docker  Runtime , Container applications can be run in a lightweight virtual machine sandbox environment , Have a separate kernel , Better security isolation capability , Compared with the community  Kata Container  More stable .

• Container runtime security ： The end customer uses the runtime security monitoring and alarm capabilities of the cloud security center container , Including virus and malicious program attacks in the container or at the host level 、 Intrusions inside containers 、 Main container side attacks such as container escape and high-risk operation warning , Help customers find security threats in assets in a timely manner 、 Grasp the asset security situation in real time .

In the safe operation stage , Customers can use  ACR  Automatic synchronization 、 Automatic scanning 、 Automatic endorsement ,ACK  Automatic signature verification 、 Automatic policy enforcement , And automatically block the follow-up process function after risk identification , Realize containerization  DevSecOps  Automated processes . By subscribing  ACR、ACK、 Risk events of cloud security center , Implement mirrored content 、 Image delivery 、 Container deployment 、 Risk perception of the whole process security during container operation , It can handle security risks more timely and efficiently , Realize global risk perception .

Alicloud carries  Salesforce  It has been awarded as an excellent case of software supply chain security of ICT Academy

2022  year  6  month  17  Japan , By China Academy of information and communication 、 Sponsored by China Communications Standardization Association  2022  First  3SCON “ Software supply chain security forum ” Held online . At the meeting, Alibaba cloud teamed up  Salesforce  Declared containers  ISV  Software supply chain security practice cases “ Alibaba cloud helps  Salesforce  Practice of software supply chain security implementation ”, After independent declaration 、 Layer by layer screening of expert review and other links , Finally, he won the award “2022  Excellent cases of the security guard program ”.

Salesforce  Jointly release software for the Chinese market with Alibaba cloud “ Salesforce  Social electricity ” In the process , Through close cooperation with Alibaba cloud container team , Dealing with the complexity of cloud native scene software 、 Diversity challenges , The software supply chain security practice of the whole life cycle has been well implemented , Mainly reflected in the following aspects ：

Improve the security of the whole link

• Safe delivery ： adopt  ACR  Cross user synchronization links ensure the distribution security of images and signatures . adopt  ACR  Image tagging and  ACK  Cross account verification ensures that the contents of the image are trusted . And because the whole delivery process is based on the exclusive synchronization link , It can ensure that the information transferred in the software supply chain will not be accidentally disclosed .

• The security policy ： Turn on  ACR  Mirror security scan policy , Ensure the content security of the image while blocking the delivery of the risk image . The implementation of  ACK OPA  Deploy policy management , Ensure that the container application configuration is effectively constrained to block the operation of similar privileged containers .

• Safe operation ： be based on  ACK  Safe sandbox container running container , The application runs in a lightweight virtual machine sandbox environment , Have a separate kernel , Better security isolation capability . Based on the cloud security center container runtime security monitoring and alarm capabilities , Avoid malicious attacks at the container or host level , Early warning of high-risk operations .

Improve the efficiency of safety management

• Highly automated ： adopt  ACR  Automatic synchronization 、 Automatic scanning 、 Automatic endorsement ,ACK  Automatic signature verification 、 Automatic policy enforcement , And automatically block the follow-up process function after risk identification , Realize containerization  DevSecOps  The process of .

Alibaba cloud container service escorts the upgrading of the original biochemical architecture of the enterprise cloud

meanwhile , stay  6  month  15  Japanese  2022  At the cloud Primary Industry Conference , Alibaba cloud is in the ICT Institute “ Cloud native security maturity ” In the evaluation , It has also obtained the only nationwide highest level certification in China . Xintong hospital “ Cloud native security maturity ” From infrastructure security 、 Cloud native infrastructure security 、 Cloud native application security 、 Cloud native R & D and operation security and cloud native security  5  Dimensions , total  315  Three sub items examine the security level of Enterprise Cloud native architecture . Alibaba cloud's native application platform is polished by large-scale enterprise customer service accumulation and innovative technology , Cloud native security solutions that precipitate the full link , It comprehensively demonstrates the richness and leadership of the security capabilities of Alibaba cloud's native products .

Mirror the service from the container  ACR、 Container services  ACK  To Cloud Security Center , Alibaba cloud's rich cloud native security product family ensures Alibaba's own large-scale cloud native biochemical practice , Ensure cloud native security throughout the application lifecycle . At the same time, these cloud native security capabilities also support millions of cloud enterprises , It improves the full link security and security governance efficiency of the software supply chain within and between enterprises .

Alibaba cloud will continue to innovate in the field of cloud native security , Through products 、 technology 、 Deep integration of safe operation , Provide multiple deployment scenarios on the cloud side , Microservices 、 In the form of multi business without service , Deeper 、 More intelligent and autonomous software supply chain security , To ensure the upgrading of cloud original biochemical architecture for enterprise customers .

2022  year  6  month  23  Japan -7  month  23  Japan , Click to read the original text and fill in the questionnaire , Purchase Alibaba cloud container image service enterprise edition for the first time  ACR EE、 Container services professional  ACK Pro  Customers of  7  A discount , Details click

here

understand .