Immutability for PCF: Security in a Cloud Native World
summary
A thin nested hypervisor called the Metavisor boots beneath Cloud Foundry stem cells and Diego cells, enforcing immutability even if an attacker gains root by making kernel regions and files read‑only and blocking privilege escalation; policies trigger memory dumps, isolation or network quarantine. The platform bundles server guard, network guard and data guard for tag‑based microsegmentation, block‑level encryption with HSM key release, and reports for auditors, with measured overheads typically in the 3–10% range.
AI-written summary · about
chapters (9)
- 0:00Introduction to immutability security
- 2:25Evolution of cyber threats
- 6:57Introducing the Medivizor hypervisor
- 10:07Enforcing immutability in production
- 14:41Preventing attacker persistence
- 16:51Encrypting data at rest
- 20:00Multi-cloud security architecture
- 22:51Summary and benefits of the approach
- 24:03Q&A on encryption and performance
related talks
02mCloud Foundry
22mKeynote: Cloud Native Security: Rotate, Repair, Repave
28mDelivering a CF Platform for Data Protection Services at Gemalto - Dan Young
33mCloud Foundry Runtime PMC Overview - Dieu Cao, Pivotal
11mOpening Remarks - Chip Childers, CTO, Cloud Foundry Foundation
37mStay Out of My Yard! Isolation Segments - a New Feature for Isolating Workloads in Cloud Foundry
09mEnterprise-Ready PCF - Making The Cool Super Cool
43mFreedom, security and the cloud