September 2020 Summaries

AWS threat detection can be enhanced by using Sysdig Secure in conjunction with AWS CloudTrail and the Sysdig Cloud Connector, which together provide a robust framework for identifying and responding to potential security threats. As microservices and DevOps practices become more prevalent, they bring new security challenges, including unauthorized cloud API requests that can affect infrastructure performance and costs. GitOps practices help manage these risks by treating infrastructure changes as code, although manual changes can still occur and potentially lead to vulnerabilities. AWS CloudTrail serves as the foundation for operational auditing by logging all account activity, which is then analyzed by the Sysdig Cloud Connector in real-time against a set of predefined and customizable security rules using Falco, an open-source runtime security project. The integration with AWS CloudTrail allows security teams to detect anomalies and potential threats efficiently, providing notifications through various channels, including AWS Security Hub, without leaving the AWS console. Sysdig Cloud Connector's deployment is straightforward, enabling organizations to enhance their AWS security posture quickly and effectively by leveraging existing AWS services and security standards.

AWS Fargate, combined with Amazon Elastic Container Service (ECS), offers a serverless compute engine that allows for the rapid deployment of containerized workloads without the need for infrastructure management. Despite its convenience, this approach can expose vulnerabilities if left unattended, potentially leading to security breaches and increased costs. Automating image scanning within the AWS environment can mitigate these risks by detecting vulnerabilities and misconfigurations before they impact production. Sysdig's inline image scanning solution for ECS Fargate, integrated via AWS CloudFormation, provides an efficient way to automate this process. This method involves leveraging AWS Lambda, Amazon EventBridge, and a CodeBuild pipeline, ensuring that container images are assessed against security policies without leaving the AWS infrastructure. This approach enables scalable security oversight, centralizing security reports and compliance status within the Sysdig platform, thereby enhancing the security posture of AWS container services without compromising flexibility.

Prometheus has become an essential tool for monitoring in cloud-native environments, specifically within Kubernetes, but many applications and services do not naturally expose Prometheus-formatted metrics, necessitating the use of Prometheus exporters. These exporters help expose necessary metrics and ensure monitoring solutions are effective and scalable. Best practices for using Prometheus exporters include selecting well-maintained projects, understanding the exporter metrics, setting actionable alerts, enabling team access to data, and planning for future scalability. These steps help reduce maintenance burdens and enhance productivity by allowing teams to focus on impactful work rather than constant configuration management. Sysdig offers a solution to streamline these practices, providing comprehensive Prometheus compatibility, out-of-the-box dashboards, and guided onboarding to optimize performance and availability.

In September 2020, Sysdig provided updates on various developments, including enhancements to their open-source security tool, Falco, which now offers continuously updated expert-written rules through Falco Feeds. Sysdig's latest updates also include new features for their Sysdig Agent, such as the ability to scrape Prometheus metrics from containers with specific IP addresses and a default enabled option for the use_forwarder feature. Additionally, the release notes highlight fixes for issues affecting Kubernetes pods and the embedded web server for audit events. The company introduced Helm chart v1.10.0 to support Sysdig Agent v10.4.1 and launched new website resources like Promcat.io. Sysdig participated in KubeCon EU, featuring keynotes and sessions now available on demand, and offered insights into Kubernetes v1.19's enterprise features. The company also addressed vulnerabilities in the slim agent and provided new blogs and webinars on topics like Kubernetes monitoring, container security, and DevSecOps practices.

Kube-apparmor-manager is an open-source tool designed to manage AppArmor profiles in Kubernetes clusters, which helps to reduce the attack surface by confining applications to a limited set of resources. AppArmor, a Linux kernel security module, utilizes profiles to specify the resources an application can access, thereby enhancing security by limiting potential attack points. Implementing AppArmor in Kubernetes involves installing it on all cluster nodes, copying profiles to each node, and configuring container workloads to use these profiles. Kube-apparmor-manager introduces a novel approach by representing profiles as Kubernetes objects through a Custom Resource Definition, facilitating easier management and synchronization across nodes without introducing privileged workloads. The tool also integrates with Sysdig Secure's image profiling feature to build robust profiles by learning expected behaviors of container activities, which can then be used to create runtime policies to protect against abnormal behaviors such as reverse shell attacks. This approach underscores the importance of understanding container activities to develop effective AppArmor profiles and demonstrates how kube-apparmor-manager can streamline AppArmor management in Kubernetes environments.

CVE-2020-14386 is a high-severity kernel vulnerability affecting Linux versions newer than 4.6, allowing unprivileged local processes to gain root access by exploiting a bug in the packet socket facility. This vulnerability poses significant risks to data confidentiality and integrity, particularly in containerized environments like Kubernetes, where it can lead to container escapes and elevated process permissions. Mitigation strategies include patching operating systems, disabling the CAP_NET_RAW capability, and configuring Kubernetes Pod Security Policies. Tools like Falco and Sysdig Secure are instrumental in detecting and mitigating such threats by providing real-time runtime threat detection and alerting, leveraging community-contributed rules to identify malicious activities, and enabling automated responses to suspicious behaviors. These tools emphasize the importance of runtime detection and least privilege access control to maintain security in containerized and cloud-native environments.

Sysdig has successfully integrated its monitoring and security software with AWS Outposts, achieving the AWS Outposts Ready designation, which enables businesses to extend AWS infrastructure and services to their own data centers or edge locations for hybrid cloud use cases. AWS Outposts allows the operation of container-based services, such as Amazon EKS and ECS, without the need for additional container orchestration software, making it suitable for applications requiring low latency and local data processing. Sysdig offers a unified SaaS-based solution for monitoring and securing AWS Outposts and AWS public cloud deployments, providing capabilities such as metadata collection, performance monitoring, security event detection, and compliance auditing. The company's approach simplifies onboarding and enhances security and visibility, allowing developers to focus on software creation rather than operational complexities. Testing has shown that Sysdig's solutions work consistently on both AWS Cloud and AWS Outposts, ensuring seamless integration and centralized management for hybrid cloud environments.

Kubernetes monitoring poses unique challenges due to the dynamic and ephemeral nature of containerized environments, which complicates understanding and troubleshooting. Effective monitoring requires adopting Secure DevOps practices that integrate security and monitoring across the application lifecycle, providing visibility and efficiency. Best practices for Kubernetes monitoring include obtaining deep system visibility, evaluating instrumenting strategies, capturing historical system data, inspecting the Kubernetes control plane, correlating metrics and events, utilizing out-of-the-box dashboards and alerts, and considering SaaS-based solutions for scalability and ease of use. By following these practices and choosing the right tools, such as those offered by Sysdig, organizations can enhance performance, availability, and troubleshooting capabilities in their Kubernetes environments.

The Sysdig Secure DevOps Platform is now accessible via the Red Hat Marketplace, an open cloud marketplace designed for enterprise clients to discover, purchase, and manage certified container-based software across various cloud environments. This marketplace, developed in collaboration with Red Hat and IBM, offers a seamless, hybrid multi-cloud experience with robust support and integration capabilities. It simplifies the acquisition and deployment of tools like Sysdig, which enhances security, compliance, and monitoring within DevOps workflows on Red Hat OpenShift. This platform allows for consistent application management across diverse infrastructures, ensuring flexibility and protection against vendor lock-in. The partnership between Sysdig and Red Hat aims to streamline software adoption and assist organizations in thriving in a hybrid multi-cloud environment.

The text discusses the transformative impact of cloud applications and secure DevOps practices on businesses, especially highlighted during the global pandemic when many companies had to scale rapidly to meet increased demand. It emphasizes the shift from monolithic to modular application development using containers, which allows for faster innovation and reduces risks. The adoption of a DevOps approach enables continuous improvement and frequent updates, moving from yearly to weekly or daily releases. Secure DevOps, or DevSecOps, integrates security into the entire application lifecycle, enhancing stability and performance. The text also highlights the importance of using modern tools for monitoring containerized environments to maintain application health and security, drawing an analogy to maintaining a car with the right diagnostic tools. By embedding security and compliance into development processes, organizations can minimize delays and address issues proactively, leading to better customer and employee experiences and strengthening their competitive position.

Kaizhe Huang shares his journey in the security industry, emphasizing the value of open-source contributions to securing cloud-native environments, particularly through tools like Falco, Prometheus, and Sysdig. With over a decade of experience in security, Huang has co-authored the book "Learn Kubernetes Security," which offers practical guidance on using open-source tools to enhance Kubernetes security. His involvement with the open-source community has been pivotal in his learning process, allowing him to share insights and best practices for protecting Kubernetes deployments. The book aims to provide readers with a comprehensive understanding of Kubernetes architecture, security integrations, threat modeling, and the deployment of security tools. Huang expresses gratitude for his experiences at Sysdig and the collaborative efforts within the open-source community to improve cloud-native security.