On-Demand Recording: https://www.nginx.com/resources/webinars/secure-your-kubernetes-apps-from-attacks-with-nginx/ With more and more organizations conducting business with their customers online, web applications remain the top attack target for cybercriminals. It’s easy to see why; they are often complex, composed of microservices, and spanning distributed environments, increasing the number of endpoints vulnerable to exploitation. It is no surprise that OWASP Top 10 vulnerabilities such as SQL injection and cross scripting (XSS) remain popular cyberattacks. You need to strengthen security for your containerized apps deployed in Kubernetes by adding a WAF to NGINX Ingress Controller. In this webinar we look at the cost of a typical application hack and why traditional WAFs don’t work for today’s modern applications. We conclude with a demo that showcases how by combining NGINX Ingress Controller with NGINX App Protect WAF you can protect your apps against common vulnerabilities, create granular policies for app services, and make your Kubernetes clusters a safer place to run your apps.

1. Secure Your Kubernetes Apps
from Attacks with NGINX
Thelen Blum – Sr. Product Marketing Manager, F5 NGINX
Amir Rawdat– Technical Marketing Engineer, F5 NGINX

2. ©2022 F5
2
Agenda
Modern Application vs. Security Adoption Rates
The Cost of a Breach
Why Modern Application Security Needs a WAF
How to Easily Secure Your Kubernetes Apps with
NGINX App Protect WAF and NGINX Ingress Controller
Demo
Q & A

3. ©2022 F5
3
APP PORTFOLIOs GROW AND MODNERNATION CONTINUES WITH MULTI-CLOUD DEPLOYMENTS
How Many Apps do Most Organizations Have Today?
Source: F5 State of Application Strategy Report 2022
- up 31% from 5 years ago
77% of those surveyed run apps in
multiple clouds with 95%
modernizing older applications.

4. ©2022 F5
4
MORE THAN TWO-THIRDS OF ORGS ARE USING AT LEAST TWO METHODS TO CREATE MODERN WORKFLOWS
Application Modernization Continues to Rise
- over 2020
Source: F5 State of Application Strategy Report 2021

5. ©2022 F5
5
CONTAINERS FOUND TO LACK SECURITY DUE TO CODE AND CONFIGURATION VULENRABILITIES
Web Applications Remain a Top Attack Vector
Source: Forrester, The State of Application Security, 2021

6. ©2022 F5
6
HOW SECURE IS YOUR ORGANIZATION?
The Severity of Recent Security Breaches
• 2021 Vulnerability in Java logging library Log4j
• Remote Code Execution / attacker full sys. access
control
• Still over 90,000 internet facing apps and 68,000
servers still publicly exposed
• 2021 Facebook Data Breach of 533M individual’s
personal information
• Data scraped from Facebook servers
• Due to a misconfiguration error
• 2017 Equifax Data Breach of 147.9M individual’s
personal information – 40% of the US population
• Thought to be State Sponsored
• Started due to a known vulnerability that was
never patched

7. ©2022 F5
7
INCREASED BY THE LARGEST MARGIN IN SEVEN YEARS
The Average Cost of a Data Breach up 10% from 2020
Source: Ponemon and IBM Security Cost of a Data Breach Report 2021

8. ©2022 F5
8
MOST SIGNIFICANT COST SAVINGS IN THE 2021 IBM COST OF A DATA BREACH REPORT
Security Automation and AI Reduced Breach Costs by 80%
Source: Ponemon and IBM Security Cost of a Data Breach Report 2021

9. ©2022 F5
9
Software Vulnerabilities & Common Attack Vectors
SOFTWARE VULNERABILITIES
IN APPLICATION STACKS (CVEs)
Software vulnerabilities are found in components
of virtually all software stacks
• Operating systems (Windows, Linux, containers)
• Application servers
• Support libraries
• Programming languages
• 3rd party libraries (NPM, CPAN, Ruby Gems)
Threats such as Injection and XSS are well known,
but difficult to mitigate, thus remarkably common
• Injection
• Cross Site Scripting
• Cross-site request forgery
• Insecure deserialization
FREQUENTLY OCCURRING
WEAKNESSES IN APPLICATION
CODE (OWASP Top 10)

10. ©2022 F5
10
What’s a Web Application Firewall (WAF)?
ENABLE PROTECTION AGAINST APPLICATION LAYER 7 ATTACKS

11. ©2022 F5
11
Why a Traditional Firewall won’t Secure your Applications
A WAF ENABLES PROTECTION AGAINST APPLICATION LAYER 7 ATTACKS
Blocked by a NW Firewall Blocked by WAF
Legitimate Traffic
WEB APPLICATION FIREWALL vs. NETWORK FIREWALL

12. ©2022 F5
12
Strong App and
API Security
Built for
Modern Apps
CI/CD
Friendly
NGINX App Protect WAF

13. ©2022 F5
13
Strong App and
API Security
App and API security and controls
built using F5 advanced WAF
technology. Blocks attacks and helps
prevent downtime.
OWASP Top 10
Regulatory Compliance
IP Blocking Prevent sensitive
data loss
F5-based Layer 7
Attack Protection
API Security

14. ©2022 F5
14
Built for Modern Apps
High performance security, low latency
and highly scalable.
Seamless integration into the #1 web application platform
High performance
Deployment options Minimizes tool
sprawl
Lightweight
footprint
Seamless NGINX
Integration
20X+ faster than
alternative OSS

15. ©2022 F5
15
CI/CD Friendly
Enable security to keep pace with
DevOps and Support “shift left”
initiatives
Declarative policies
Speed Time to
Market
Enable AppDev
Reduced cost
Feedback loops
Automate security
in CI/CD cycle

16. ©2022 F5
16
NGINX App Protect WAF Deployment Options
3

17. ©2022 F5
17
Fully Integrated Solution
• Configured from familiar, powerful
K8s API
• Integrates security and WAF
natively into the CI/CD pipeline
Business Benefits
• Reduce complexity and tool sprawl
• Accelerate time to market and
reduces costs with
DevSecOps-automated security
• Achieve resilience, visibility and
security
Easily Secure your Kubernetes Apps and Services with
NGINX App Protect WAF and NGINX Ingress Controller
we are here
SECURE YOUR KUBERNETES ENVIRONMENT AT SCALE

18. ©2022 F5
18
NGINX Ingress Controller
A SPECIALIZED LOAD BALANCER FOR KUBERNETES ENVIRONMENTS
Kubernetes
Node
Kubernetes
Node
Kubernetes
Node
Ingress controllers
Load balancer
Users
• Accepts traffic from outside the
Kubernetes platform, and load-balances
it to pods (containers) running inside the
platform
• Configured using the Kubernetes API,
with objects called ‘Ingress Resources’
• Monitors the pods running in
Kubernetes, and automatically updates
the load balancing rules if, for example,
pods are added or removed from a
service

19. ©2022 F5
19
Choosing your Model for App Protection
SNI VS PATH-BASED

20. ©2022 F5
20
CONFIDENTIAL
Host
TLS
Upstreams
Routes
- Path
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
optional
Host
TLS
Upstreams
Routes
- Path
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
optional
NGINX Ingress Resources – Rich Capabilities
Host
TLS
Policies
Upstreams
Routes
- Path
Policies
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
VirtualServer
pass
redirect
return
proxy
pass
redirect
return
proxy
Host
Upstreams
Subroutes
- Path
Policies
Action
Split
Match
ErrorPage
pass
redirect
return
proxy
VirtualServerRoute
NGINX server configuration
NGINX http configuration
Server and HTTP snippets
NGINX location configuration
Location snippets
Policies
Access Control
Rate Limiting
Auth (JWT, OIDC)
MTLS (Ingress/Egress)
App Protect WAF

21. ©2022 F5
21
NGINX App Protect WAF – Visibility Integrations

22. ©2022 F5
22
Demo

23. ©2022 F5
23
A LIGHTWEIGHT, HIGH-PERFORMANCE MODERN APP SECURITY SOLUTION
NGINX App Protect WAF Delivers Strong Kubernetes App Security
Security policies and protections
are optimized for DevOps
workflow.
Deploy and manage app security
controls across distributed
environments.
Embed Security Policy
Into Your Pipeline
Integrate security controls directly into
your pipeline with security as code.
Secure Modern Apps
Strong security controls for
microservices, containers, APIs, and
other modern topologies.
Gain Security Insights
Security tools that go beyond alerts
with intelligent security insights about
your apps and APIs.
Centralized visibility and insights
dig into the root cause of
application issues.

24. ©2022 F5
24
Q & A

25. ©2022 F5
25
Test Drive NGINX for yourself with a 30-day FREE Trial Today!
https://www.nginx.com/free-trial-request-nginx-ingress-controller/
If you would like to try today’s presented demo for yourself, you can access it from the
GitHub Repo located here: https://github.com/rawdata123/app-protect-sni/tree/master