July 2019 Summaries

Helm is the package manager for Kubernetes, enabling the installation of applications on Kubernetes clusters similarly to how yum or apt functions for Linux distributions. It offers features like integrated testing hooks, built-in rollbacks, release history, and chart dependencies, enhancing the lifecycle management of cluster applications. Despite the production-readiness of Helm 2, it faced adoption resistance due to misconceptions about its capabilities and its dependency on Tiller. Helm 3, which no longer requires Tiller, addresses these issues and is a client-only application that adheres to Kubernetes' RBAC security constraints. The new version supports using Helm 2 charts, facilitating transition for companies already using Helm 2, and has achieved general availability status, with support for deployment using platforms like Codefresh.

Implementing continuous integration and continuous deployment (CI/CD) platforms brings the advantages of rapid and frequent software release cycles, but it necessitates robust security measures, particularly in container image creation and deployment. Scanning Docker images during the CI stage is crucial for identifying security vulnerabilities early, allowing developers to address issues before deployment. Aqua Security enhances container, serverless, and cloud-native application security across all platforms by integrating with tools like Codefresh, offering an automated image scanning step to detect vulnerabilities, malware, and configuration issues. This integration allows the enforcement of flexible security policies, differentiating between various application types and environments, and provides feedback directly within the CI environment to ensure that non-compliant images are addressed promptly. By setting policies to either alert or fail non-compliant builds, Aqua Security helps prevent security issues from reaching staging environments and enables blocking of non-compliant images across Kubernetes clusters, thus integrating multiple security checkpoints into the CI/CD process.

The text discusses the role of log management in security analytics, emphasizing the centrality of logs in systems like the ELK Stack, which comprises Elastic Search, Logstash, and Kibana. While traditional SIEM solutions such as AlienVault, QRadar, and Splunk offer comprehensive capabilities, the ELK Stack is increasingly being utilized as a more agile, cost-effective alternative for log management and analysis. However, it lacks certain out-of-the-box SIEM capabilities, requiring integration with additional tools for functionalities like alerting, correlation, and incident management. Various solutions have emerged to enhance ELK's capabilities in security analytics, such as Logz.io, which adds threat detection and dashboards, and Elastic SIEM, which offers a dedicated UI for event analysis but is still in beta. Wazuh, another option, provides a more comprehensive list of security-focused features while using ELK for log storage and analysis. Despite its limitations, ELK's open-source nature offers a solid foundation for developing more complete security systems, contributing to its growing popularity in the security analytics market.