Open source solutions company Red Hat has announced its intent to acquire StackRox, an innovator in container and Kubernetes-native security. The acquisition would further RedHat’s vision to deliver a single, holistic platform that enables users to build, deploy and securely run nearly any application across the entirety of the hybrid cloud.
Founded in 2014, StackRox was created with a goal of reinventing enterprise security and has evolved over the past two years to focus on Kubernetes security. Unlike first generation container security platforms, which were often container-centric offerings, StackRox would differentiate with a Kubernetes-native security platform. With this, organizations can more easily control and enforce policies, using the same declarative approach as Kubernetes to scale their applications while still maintaining the necessary security.
Consistent with Red Hat’s open source heritage, Red Hat plans to open source StackRox’s technology post acquisition. Red Hat will continue to support the ‘KubeLinter’ community as well as new communities as Red Hat works to open source StackRox’s offerings. The transaction is expected to close in the first quarter of 2021, subject to customary closing conditions.
Security Proposition
With this acquisition, Red Hat is aiming at further expanding its security proposition, adding StackRox’s complementary capabilities to strengthen integrated security across its open hybrid cloud portfolio “with greater simplicity and consistency.” With StackRox, Red Hat will focus on transforming how cloud-native workloads are secured by expanding and refining Kubernetes’ native controls. as well as shifting security left into the container build and CI/CD phase, to provide a cohesive solution for enhanced security up and down the entire IT stack and throughout the lifecycle
“Securing Kubernetes workloads and infrastructure cannot be done in a piecemeal manner; security must be an integrated part of every deployment, not an afterthought,” said Paul Cormier, president and CEO of Red Hat. “Red Hat adds StackRox’s Kubernetes-native capabilities to OpenShift’s layered security approach, furthering our mission to bring product-ready open innovation to every organization across the open hybrid cloud across IT footprints.”
StackRox Policy Engine
The StackRox software provides visibility across all Kubernetes clusters, by directly deploying components for enforcement and deep data collection into the Kubernetes cluster infrastructure. This would reduce the time and effort needed to implement security, and streamline security analysis, investigation and remediation. The StackRox policy engine includes hundreds of built-in controls to enforce security best practices, industry standards such as CIS Benchmarks and NIST, and configuration management of both containers and Kubernetes, and runtime security.
In addition to Red Hat OpenShift, StackRox will continue to support multiple Kubernetes platforms, including Amazon Elastic Kubernetes Service (EKS), Microsoft Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE).
StackRox would also help to simplify DevSecOps and enable cloud-native environments to be more intrinsically secure, by integrating directly into application pipelines and customers’ existing registry, image scanning and CI/CD tools. In October 2020, StackRox launched KubeLinter, an open source project that analyzes Kubernetes YAML files and Helm charts for correct configurations, with a focus on enabling production readiness and security earlier in the development process.
“We’re thrilled to join forces with Red Hat, coupling the industry’s first Kubernetes-native security platform with the leading Kubernetes platform for hybrid cloud, multicloud, and edge deployments,” said Kamal Shah, CEO of StackRox. “This is a tremendous validation of our innovative approach to container and Kubernetes security. Red Hat is an ideal partner to accelerate our vision of enabling organizations to securely build, deploy and run their cloud-native applications anywhere.”
