May 2020 Summaries

Kaizhe Huang's blog post discusses the detection of the CVE-2020-8555 vulnerability using Falco, an open-source tool for runtime threat detection in containers and Kubernetes. The vulnerability is a Server Side Request Forgery (SSRF) in kube-controller-manager, allowing certain authorized users to leak data from the master's host network. It affects specific Kubernetes versions and is associated with certain storage volume types, including GlusterFS, Quobyte, StorageFS, and ScaleIO. Falco can be configured to detect attempts to exploit this vulnerability by writing customizable rules to monitor for the creation of vulnerable Pods or StorageClass objects. The post emphasizes the importance of detecting exploitation attempts and suggests mitigating the vulnerability by adding endpoint protections, restricting the use of vulnerable volumes, and controlling StorageClass write permissions through RBAC.

Reverse shell attacks, which exploit application vulnerabilities to grant attackers interactive access to victim systems, can be effectively detected using tools like Falco and Sysdig Secure. Falco, a CNCF project, identifies abnormal behaviors in applications, containers, and hosts, while Sysdig Secure not only detects but also responds to such anomalies. Attackers often use reverse shells to perform reconnaissance, escalate privileges, steal data, or install malware like crypto miners. These attacks typically involve reversing the roles of client-server connections to bypass firewalls, with tools like netcat commonly used to establish these connections. Detection involves recognizing deviations from expected behavior, such as unexpected network connections or shell executions, particularly in microservice environments where container behavior is usually predictable. Falco utilizes rules to identify such deviations, while Sysdig Secure employs image profiling to learn normal container behavior, thus enabling the detection of unauthorized activities. Advanced reverse shells, which may not use straightforward methods like netcat, require comprehensive monitoring of system activities to ensure they are detected promptly.

IBM and Sysdig have expanded their collaboration to enhance cloud security governance by integrating Sysdig Secure and the Sysdig Secure DevOps Platform with IBM Cloud Pak for Multicloud Management. This integration offers centralized cloud visibility, governance, and automation, specifically strengthening container security intelligence for Red Hat OpenShift. The partnership addresses the complexities of managing security, visibility, and compliance in hybrid and multicloud environments, which have grown more critical with the rise of containerized applications. Sysdig's platform, designed for cloud-native environments, provides runtime security, threat detection, and incident response capabilities, leveraging CNCF's open-source Falco project for real-time threat detection. By centralizing security findings and integrating them into a unified dashboard, the collaboration aims to streamline the management and resolution of security issues, offering enterprises a comprehensive approach to maintaining security and compliance across multicloud architectures. The offering is supported by a 60-day free trial for Red Hat OpenShift users to explore the integration's capabilities.

In the pursuit of improving Prometheus monitoring for AWS CloudWatch, the Sysdig team enhanced the Yet Another CloudWatch Exporter (YACE) to ensure it is production-ready, focusing on stability and cost-effectiveness. These enhancements include optimizing API calls to prevent throttling and reduce billing costs, achieved by implementing a proxy mechanism that decouples metric serving from data querying, thus reducing API call frequency. The article explains how these improvements allow Prometheus to effectively integrate and monitor AWS CloudWatch metrics, enabling the use of PromQL for advanced querying and creating a robust observability stack. Additionally, the YACE exporter now supports AWS Fargate metrics, enriching resource monitoring capabilities, and further optimizations were made to handle errors more reliably, making it suitable for production environments. These contributions support the synergy between AWS CloudWatch and Prometheus, offering a comprehensive monitoring solution that leverages the strengths of both platforms.

Sysdig has enhanced its alerting experience by integrating with PagerDuty, allowing users to manage notifications more efficiently. This integration is one of the most utilized features within the Sysdig platform, enabling automatic routing of Sysdig-generated alerts through PagerDuty for streamlined on-call management. The collaboration between Sysdig and PagerDuty is further strengthened by the synchronization of notification statuses across both platforms; alerts that resolve to an acceptable state in Sysdig are automatically updated to "OK" in PagerDuty, and manual resolutions are also supported. This feature is designed based on user feedback to improve workflow efficiency and keep notification lists clean by preventing duplicate alerts in multiple interfaces. Sysdig aims to continue refining this integration based on ongoing user input, and new users are encouraged to explore the system through a free trial.

Sysdig has introduced a scalable, fully compatible Prometheus monitoring solution to address the challenges associated with monitoring Kubernetes environments as they grow increasingly complex and diverse. The integration maintains compatibility with existing Prometheus setups, allowing organizations to leverage their current investments in dashboards and query languages while enhancing enterprise functionality with features like role-based access control and team management. Sysdig's approach involves deploying a lightweight Prometheus server within its agent and using a combination of open-source technologies like Cassandra and Kafka to handle data ingestion and querying at scale. The company also launched PromCat.io, a repository for Prometheus exporters, dashboards, and alerts, to streamline the user experience and support community-driven monitoring solutions. Sysdig continues to evolve its platform to meet the changing needs of its customers, focusing on scalability, ease of use, and integration with cloud-native environments.

The blog post discusses the collaboration between Sysdig and IBM to enhance secure DevOps practices in edge computing environments through the IBM Edge Application Manager. This partnership aims to leverage cloud-native technologies and Kubernetes workloads to deliver faster innovation and competitive advantages at the edge of networks, extending beyond traditional data centers. The IBM Edge Application Manager facilitates the management of AI, analytics, and IoT workloads across more than 10,000 edge devices, utilizing platforms like Red Hat OpenShift or Docker. Sysdig contributes by providing a secure DevOps platform that integrates security, compliance, and performance monitoring into DevOps workflows, utilizing open-source projects like Falco and Prometheus. The collaboration is designed to address the unique challenges of edge computing, such as security and performance management, by offering solutions that enable enterprises to manage and secure their geographically dispersed edge computing infrastructures efficiently. This approach is expected to remove innovation barriers and help enterprises seize new business opportunities in various industries by ensuring robust security and operational visibility across all computing environments.