NGINX DevSecOps Workshop
- 1. NGINX App Protect DevOps Workshop Jesse Goodier NGINX Solutions Architect November 4, 2020
- 2. 2 Agenda 1. NGINX Overview 2. Demo and overview of lab 3. Hands-on lab
- 4. NGINX Application Platform A suite of technologies to develop and deliver digital experiences that span from legacy, monolithic apps to modern, microservices apps.
- 6. ENTERPRISE SOLUTIONS WITH DYNAMIC MODULES • Enterprise class visibility with 90+ additional metrics • JWT Authentication • Native OpenID Connect support • Active health checks on status code and response body • Service discovery using DNS • Key value store (dynamic IP black-listing, blue/green deployments) • Dynamic reconfiguration—zero downtime • Session persistence based on cookie NGINX Plus
- 7. New From F5! NGINX App Protect High performing Security protection beyond signatures Trusted Signatures from F5 Simple CI/CD integration Designed for modern infrastructures Rapid feedback loop for security remediations Unified F5 declarative interface Security statistics via syslog Backed by F5 Support Manage CI/CD Friendly Secure
- 9. Declarative Policy Helps CI/CD Motion INFRASTRUCTURE AND SECURITY AS CODE Source Code Repository CI/CD Pipeline Tool IT Automation Application code/config for App X security policy/config for App X Pipeline for build/test/deploy of App X Ansible playbook for deployment of App X with its app services Owned by SecOps Operated by DevOps { "entityChanges": { "type": "explicit" }, "entity": { "name": "bak" }, "entityKind": "tm:asm:policies:filetypes:filetypestate", "action": "delete", "description": "Delete Disallowed File Type" }
- 10. NGINX App Protect Performance 0 0.5 1 1.5 2 2.5 Throughput (MB/sec) No Protection NGINX App Protect ModSec 0 2000 4000 6000 8000 10000 12000 14000 Requests/sec No Protection NGINX App Protect ModSec 0 100 200 300 400 500 600 700 800 Latency (ms) No Protection NGINX App Protect ModSec Comprehensive security policy has no impact on latency, and offers better throughput and requests/second when compared to ModSec • ModSec Configuration: OWASP Top 10 (enable all CRS 3v rules) • NGINX App Protect Configuration: OWASP Top 10 (Enable signatures), Evasion technique, Data Guard, Disallowed file types, HTTP protocol compliance
- 11. 11 • NGINX commonly used as Ingress Controller • Dynamic reconfiguration of endpoints (no configuration reloading) • Additional metrics, provided by a streamlined Prometheus exporter • Dedicated Helm chart repository • Support for Custom resources to expose more (all) NGINX Plus features as an Ingress An advanced Layer 7 load-balancing solution for exposing Kubernetes services to the Internet Kubernetes Ingress Controller
- 14. 14 Hands-On Workshop To launch the lab, go to https://udf.f5.com and look for NGINX Workshop. Use chat or come off mute if you have any questions and we can help you in a breakout room. If you do not see the workshop listed on UDF, please send us your email and the system will send you an invitation. We are here to help. Login to windows jump host as user/user use web shell su ubuntu cd <ctrl><shift>v to paste on windows