March 2019 Summaries

Eric Carter's blog post, published on March 27, 2019, discusses the integration of visibility and security within AWS App Mesh using Falco Feeds by Sysdig. Falco Feeds enhances the capabilities of the open-source Falco tool by providing companies with access to expert-crafted rules that are regularly updated to address emerging threats. This resource aims to bolster cloud security by offering companies the means to preemptively adapt to new vulnerabilities.

Falco, a project under the Cloud Native Computing Foundation, is participating in the Google Summer of Code (GSoC), offering students the chance to contribute to open-source projects. Students interested in Falco can apply through the GSoC site and engage with mentors via the Sysdig OSS Slack channel. The project ideas for Falco include enhancing its output capabilities to integrate with systems like NATS and Kafka, extending its event sources beyond system calls and Kubernetes Audit Logs, and developing capabilities for Layer 7 inspection and detection in the context of zero trust networking. Other projects involve integrating Falco with AI/ML platforms for anomaly detection, creating a Prometheus metrics exporter for performance monitoring, and optimizing Falco deployment in large Kubernetes clusters. Additionally, there are opportunities to develop Falco rules profiles for application containers and security benchmarks. The initiative aims to harness the creativity and skills of students to advance Falco's capabilities.

StatsD is a widely-used monitoring solution that collects custom metrics from instrumented code, originally developed by Etsy's Erik Kastnen in Node.js but now available in multiple language implementations such as C, Golang, Python, and Ruby. The framework involves various metric types including gauges, counters, timers, histograms, meters, and sets, each serving different purposes like measuring instantaneous values, counting events, timing durations, and tracking unique occurrences. StatsD allows for decoupling application behavior from monitoring processes, but requires proper network configuration and can face challenges in containerized environments due to the loss of metric origin information and the potential for the server becoming a single point of failure. Sysdig Monitor offers an alternative approach by automatically collecting and tagging StatsD metrics in containerized applications, thus simplifying network configuration and enhancing segmentation. The blog post also provides code examples for implementing StatsD in Golang, Node.js, and Python, and suggests considering the Prometheus stack as an alternative, recommending users to evaluate their metric needs between dot-metrics and tagged metrics.

Kubernetes 1.14 introduces a range of new features and enhancements, including support for Windows Server containers, which allows developers to schedule Windows-based applications on Kubernetes, marking a significant milestone after nearly three years of effort by SIG-Windows. The update also includes the integration of Kustomize into kubectl, enabling more streamlined management of Kubernetes objects through declarative specifications, and the promotion of node OS/Arch labels to stable status, ensuring backward compatibility. Additional advancements include the graduation of HugePages support to stable, enabling better memory management for applications like databases, and enhancements in cluster operations such as dynamic HA cluster creation using kubeadm. The release also emphasizes improvements in security and storage, such as the hardening of default RBAC discovery cluster role bindings to enhance privacy and the graduation of CSI block storage support to beta, which caters to high-performance applications requiring raw block devices. Moreover, Kubernetes 1.14 enhances the plugin mechanism for kubectl, allowing simpler integration and execution of plugins, and introduces features like server-side apply to improve Kubernetes' declarative config workflow. The update continues to push for feature parity between in-tree and CSI storage plugins, with several enhancements in storage management and cloud provider support, encouraging users to upgrade their clusters to take full advantage of these new capabilities.

CVE-2019-3874 is a vulnerability in the Linux kernel that allows an attacker to bypass cgroup memory isolation through the SCTP socket buffer, potentially leading to a denial-of-service attack in containerized environments. Sysdig Falco, an open-source container security monitor, can detect and prevent this vulnerability by leveraging its rules engine to identify and stop suspicious SCTP bind attempts. The vulnerability has a CVSS rating of 5.3, with a kernel patch in development. Sysdig's platform offers a comprehensive suite of security measures, including image scanning and container compliance, to prevent exploitation and ensure best practice-based security posture in Docker and Kubernetes environments.

Prometheus metrics and OpenMetrics provide a standardized approach to code instrumentation across various programming languages such as Golang, Java, Python, and JavaScript, facilitating the monitoring of applications by collecting and exposing metrics. Originally developed at SoundCloud and now a community-driven project under the Cloud Native Computing Foundation, Prometheus uses a highly dimensional flat metric format that incorporates labels or tags, allowing for dynamic aggregation and segmentation of data. This widely adopted format has influenced other monitoring systems and has been established as an independent project, OpenMetrics, aiming to become an industry standard. The system's versatility is enhanced by client libraries that support different languages and metric types, such as counters, gauges, histograms, and summaries. Sysdig Monitor integrates with Prometheus, providing additional benefits like automated metric discovery and collection, enriched with Docker, Kubernetes, and cloud provider metadata, making it easier to monitor microservices environments. The use of Prometheus exporters allows older applications to integrate into this modern metric ecosystem by translating their native formats into the Prometheus metrics format.

A recently identified Kubernetes vulnerability, CVE-2019-1002100, affects the kube-apiserver, where authorized users with write permissions might conduct a denial-of-service attack, causing the API server to be overloaded. This medium-severity issue, with a CVSS score of 6.5, can be resolved by upgrading to specific versions of the kube-apiserver or by removing 'patch' permissions from untrusted users. Sysdig provides a cloud-native intelligence platform to mitigate such vulnerabilities by monitoring and alerting for abnormal traffic patterns that could indicate a potential DoS attack. Their tools allow users to detect unusual inbound and outbound traffic, understand the context of the attack, and inspect user commands post-incident. Despite being labeled medium severity, the vulnerability poses significant risks, especially if a malicious user compromises a container with patch privileges, necessitating diligent monitoring and security practices.

Sysdig and Anchore have collaborated to enhance container security throughout the software development lifecycle by integrating their tools and expertise. Sysdig Secure, particularly with its recent 2.3 release, offers new scanning policies to ensure compliance with standards such as NIST 800-190 and PCI, and allows for customizable rules to meet specific organizational security needs. Anchore's open-source policy engine complements these capabilities by providing community-driven guidance and policy bundles to prevent vulnerabilities in container images. This collaboration emphasizes a policy-based compliance approach to container security, leveraging continuous scanning and real-time vulnerability detection to maintain secure and compliant container environments in both development and production phases. Together, Sysdig and Anchore aim to foster a community-driven initiative to educate and enhance best practices in container security and compliance.

Containerd, a critical component in the cloud-native containerized landscape, has become an industry-standard container runtime that offers a simple, robust, and portable solution for managing containers on a host. Originating in the ecosystem's growth spurred by Docker's introduction in 2013, Containerd emerged as a response to the need for a slim runtime that could complement Kubernetes' orchestration capabilities. Its recent graduation within the Cloud Native Computing Foundation highlights its significance alongside projects like Kubernetes and Prometheus. Sysdig, a platform providing monitoring, security, and troubleshooting tools, supports Containerd by integrating its metadata alongside Docker's, offering comprehensive insights into Kubernetes and container environments. As the container ecosystem evolves, Sysdig continues to enhance its offerings to aid customers in their transition to containerization, emphasizing best-in-class cloud-native monitoring and security.