Security

Containers and hybrid cloud technologies have made the security landscape much more complex. Security teams are increasingly finding it challenging to keep up with the changing risks, compliance requirements, tools, and architectural changes introduced by these technologies.

Traditional perimeter-based network security is no longer effective on its own, and security teams must rethink their approach to incorporate modern Zero Trust Architecture principles such as microsegmentation, continuous user validation, and the prevention of lateral movement.

Security should be implemented within each layer of the application and infrastructure stack. Authorization between people and systems and between systems should be explicit instead of assumed. People and processes should be aligned to continuously monitor and address security early in an automated way.

Securing modern hybrid clouds requires layering security across your entire infrastructure stack and application lifecycles. For infrastructure within your complete control (like datacenters), Red Hat software prioritizes defense-in-depth strategies that default to Zero Trust policies. And our extensive partner ecosystem extends those same security principles to environments beyond your full control (like public clouds).

This defense-in-depth strategy frees you from relying on a single security layer. Instead, security is integrated across people, process, and technologies—from operating systems to container platforms; automation tools to Software-as-a-Service (SaaS); and as a part of cloud services.

You are only as secure as your weakest link. However, across a hybrid-cloud environment, it can be difficult to see where those links are. Starting with Linux® and beyond, Red Hat works with upstream open source communities to make enterprise-ready software that’s hardened, tested, and securely distributed.

Security is not a bolt-on afterthought. It must be integrated throughout the entire infrastructure and application stack and life cycle.

Red Hat works to help you build security into applications, deploy applications onto a hardened platform, and manage, automate, and adapt your infrastructure and applications as security and compliance requirements change.

• Design: Identify security requirements and governance models
• Build: Security built into the application stack and life cycle from the start, not bolted on
• Run: Deploy to trusted platforms with enhanced security capabilities
• Manage and automate: Automate infrastructure and application development for improved security and compliance
• Adapt: Revise, update, remediate as the security landscape changes

A layered, defense-in-depth security strategy across the entire infrastructure and application stack and life cycle is key to both hybrid cloud security and DevSecOps.

DevOps fused the disciplines of software development and IT operations into a collaborative way of working. Forward-looking DevOps teams recognized the importance of including security in this DevOps model, leading to the birth of DevSecOps.

DevSecOps means thinking about application and infrastructure security from the start. It also means automating security operations to keep the DevOps workflow from slowing down. 

It underscores the need to help developers code with security in mind, a process that involves security teams sharing visibility, feedback, and insights on known threats.

Cloud service provider ORock Technologies needed a technology partner to help it build a more secure enterprise open source cloud solution for government and highly regulated industries. Red Hat worked with ORock to build a cloud environment on Red Hat® OpenStack® Platform, a container service on Red Hat OpenShift®, and to gain Federal Risk and Authorization Management Program (FedRAMP) accreditation.