StackRox Selected as Accredited Kubernetes-Native Security Platform for U.S. Department of Defense Iron Bank
StackRox Kubernetes Security Platform Certified as a Standard Security and Compliance Platform in DoD’s Hardened Container Repository
MOUNTAIN VIEW, Calif., Oct. 14, 2020 — StackRox, the leader in container and Kubernetes security, today announced that the StackRox Kubernetes Security Platform has received accreditation from Iron Bank (formerly known as Department of Defense Centralized Artifacts Repository (DCAR)) as part of the DoD’s Enterprise DevSecOps Initiative. The DoD is implementing the Enterprise DevSecOps Initiative to enable agencies to develop applications more rapidly and in a more secure manner to increase the warfighter’s competitive advantage. The StackRox Kubernetes Security Platform has been certified for compliance with the DoD Enterprise DevSecOps Container Hardening guide and accredited for use by the DoD to enable automated testing and container security.
“The ability to apply DevSecOps principles to our defense systems is crucial to the United States maintaining its leadership in readiness and innovation,” said Nicolas M. Chaillan, Chief Software Officer, U.S. Air Force, and, Co-Lead, DoD Enterprise DevSecOps Initiative. “StackRox, with its Kubernetes-native approach to securing microservices environments, makes it easier for cyber teams to shift left and apply controls early in the development cycle and embed security policies in code.”
As part of the DoD’s Enterprise DevSecOps Initiative, Iron Bank was developed to offer agencies access to a wide range of hardened and centrally accredited containers with pre-selected, certified, and secured best-of-breed development tools and software capabilities. A critical element of this accreditation is the ability to ensure security activities occur in all phases of the DevSecOps application lifecycle and facilitate automated risk characterization, monitoring and mitigation. StackRox is among the first vendors included in the DoD’s DevSecOps product stack and provides a Kubernetes-native security and compliance platform that protects applications across build, deploy and runtime phases.
“As an In-Q-Tel partner, StackRox remains dedicated to supporting the U.S. Government Civilian agencies, the Department of Defense and the Intelligence Community in their modernization and transformation efforts,” said Branden Wood, Director of U.S. Federal Government for StackRox. “It is critical that our nation’s warfighters can effectively tap into the application development innovation enabled by containers and Kubernetes to build new applications faster and more securely. Our inclusion in Iron Bank is another indicator of the robust security and compliance value that the StackRox Kubernetes Security Platform delivers to defense agencies and the federal IT community. StackRox is proud to be part of the mission to make the DoD’s application infrastructure increasingly flexible, scalable and secure.”
The StackRox Kubernetes Security Platform is also listed on the Approved Product List for the Department of Homeland Security Continuous Diagnostics and Mitigation (CDM) Program. The company has helped a number of agencies accelerate modernization efforts by supporting the adoption of cloud-native infrastructure and applications in the Federal Government with its Kubernetes-native security and compliance capabilities, including:
- Visibility: Providing comprehensive visibility into container and Kubernetes deployments.
- Vulnerability Management: Integrating with CI/CD pipelines to protect containers from vulnerabilities throughout their life cycle.
- Compliance: Enabling continuous compliance checks and reporting for controls defined in CIS Benchmarks for Docker and Kubernetes, NIST SP 800-190, PCI DSS, and HIPAA.
- Network Segmentation: Implementing firewalling and segmentation policies by providing visibility, simulation, recommendations, and enforcement via Kubernetes network policies.
- Risk Profiling: Profiling overall risk across workloads by correlating and analyzing various attributes and prioritizing the riskiest deployments that need remediation.
- Configuration Management: Automating ongoing checks across environments to protect against misconfigurations in containers and Kubernetes, such as exposed dashboards or metadata.
- Threat Detection: Combining rules, whitelists, baselines, and behavioral modeling to identify threats at runtime in container environments.
- Incident Response: Automating the application of learning from incident responses to continuously improve the security posture of environments.
For more information on how to purchase the StackRox Kubernetes Security Platform for federal organizations, please visit: www.stackrox.com/solutions/federal-agencies. The StackRox Kubernetes Security Platform is also available to DoD agencies through Iron Bank. Federal customers can request access here.
Additional resources:
Kubernetes security 101
Container security 101
Federal DevSecOps summit
About StackRox
StackRox helps enterprises secure their containers and Kubernetes environments at scale. StackRox delivers the industry’s first and only Kubernetes-native container security platform that enables security and DevOps teams to enforce their security and compliance policies across the entire container life cycle, from build to deploy to runtime. The StackRox Kubernetes Security Platform integrates with existing DevOps and security tools, enabling teams to quickly operationalize container and Kubernetes security. StackRox customers span cloud-native companies, Global 2000 enterprises, and government agencies. StackRox is privately held and headquartered in Mountain View, California. To learn more, visit www.stackrox.com and follow us on Facebook, LinkedIn and Twitter.