February 2021 Summaries

Sysdig has announced the donation of its kernel module, eBPF probe, and libraries to the Cloud Native Computing Foundation (CNCF), integrating core components of Falco—a widely-used tool for runtime security and threat detection in cloud environments—into the CNCF's governance and licensing framework. This move signifies the culmination of efforts to transition these components from Sysdig's repository, further supporting Sysdig's commitment to open-source principles. By transferring ownership to the CNCF, Sysdig aims to ensure that Falco remains community-driven and fully open-source, enabling developers to build upon its powerful system call capture framework and event enrichment library. This transition is expected to enhance collaboration within the Cloud Native community, fostering the development of new tools for runtime security, incident response, and forensics.

Sysdig's February 2021 update introduces several enhancements to their platform, aimed at improving container security and usability. The release highlights include the launch of the fourth annual Sysdig Container Security and Usage report, which provides insights from nearly a billion containers, emphasizing the need for runtime security alongside shifting left in security practices. Sysdig Secure now supports multiple credentials for registry access, enhanced noise-reduction in activity audits, and expanded network security policies. There are also improvements in the Sysdig Monitor, allowing the import of Prometheus alert rules, and updates to the Sysdig Agent and Node Image Analyzer for better functionality and issue resolution. Additionally, the update features new capabilities in the Sysdig CLI and SDK, as well as improvements to the Terraform provider, Falco rules, and Promcat.io integrations.

Kubernetes admission controllers are integral to managing and securing Kubernetes clusters by intercepting requests to the Kubernetes API before they are persisted, allowing administrators to enforce policies such as resource limits, pod security, and image security. These controllers, which are built into the kube-apiserver binary and configured by the cluster administrator, ensure that deployments adhere to organizational standards by validating or mutating requests based on defined rules. They can be extended through webhooks, which enable custom functionalities such as image scanning, ensuring that only secure and compliant images are deployed. This extension capability allows organizations to tailor Kubernetes operations to specific security needs, enhancing the cluster's reliability and security. Admission controllers are essential for implementing preventive security measures and can be integrated with third-party tools to further enhance Kubernetes' API functionality.

Implementing image scanning on Kubernetes admission controllers provides a robust last line of defense for securing clusters by ensuring that all deployed images adhere to security policies. Admission controllers, a native Kubernetes feature, intercept API requests before object persistence, enabling them to block the deployment of non-compliant images. Various strategies exist for implementing this, ranging from DIY open-source integrations using tools like Anchore, Falco, and OPA, to commercial solutions like the Sysdig Admission Controller. The latter offers streamlined setup and operation, with features such as centralized scan results, policy reuse, and continued protection even during connectivity issues. Incorporating image scanning at this stage complements other security measures, addresses vulnerabilities in manual deployments, and enhances overall cluster security.

Prometheus has become the preferred tool for monitoring Kubernetes environments, owing to its capabilities such as a multi-dimensional data model, accessible metrics format, service discovery, and modular components. This guide details how to implement Kubernetes monitoring with Prometheus, covering steps like deploying a Prometheus server, setting up metrics exporters, and configuring alerts with Alertmanager and dashboards with Grafana. It also discusses the advantages of Prometheus over traditional monitoring tools, particularly within the context of DevOps and containerized infrastructures, and explores how Prometheus handles challenges posed by ephemeral and dynamic entities in Kubernetes. The guide further explains how to install Prometheus in various ways, including using Helm charts and the Prometheus operator, and provides insights into monitoring Kubernetes clusters, nodes, and services using Prometheus exporters. Additionally, it highlights the importance of using tools like PromCat.io for managing Prometheus exporters and scaling Prometheus with tools such as Cortex and Thanos for complex environments.

Runtime security in Azure Kubernetes Service (AKS) involves implementing controls to detect unexpected or malicious behaviors, as traditional methods like container image vulnerability scanning are insufficient for comprehensive protection. Falco, an open-source Kubernetes runtime detection project created by Sysdig, is highlighted as a crucial tool for identifying runtime threats by analyzing system calls and incorporating Kubernetes context. It provides a flexible rules engine for writing custom detection rules and integrates with security workflows. Sysdig Secure extends Falco's capabilities with a user-friendly interface, offering out-of-the-box policies and a centralized management system to enhance security across container and Kubernetes environments. This approach helps detect zero-day vulnerabilities and unauthorized activity while facilitating compliance and incident response in cloud-scale operations.

As Kubernetes usage grows, integrating Kubernetes audit logs is vital for enhancing security strategies by providing visibility into cluster events and enabling detection of suspicious activities. Introduced in Kubernetes 1.11, audit logs capture key events like deployments and namespace deletions, which can be parsed by security tools such as Falco to alert on threats. Falco, an open-source runtime security tool, acts as a webhook backend to ingest these logs, offering real-time threat detection with customizable rules. Kubernetes audit logs allow security teams to track what happened, identify responsible users, and understand event timelines and locations, thus aligning with compliance requirements. Configuring audit policies lets users filter desired events, reducing unnecessary verbosity and potentially lowering costs, especially when using SaaS logging solutions. The integration of Falco as a threat detection engine is emphasized as a crucial step in enforcing Kubernetes security best practices and bridging the gap between perceived and actual cluster activities.

The blog post outlines a method for monitoring Amazon SQS (Simple Queue Service) using Prometheus, a popular open-source monitoring solution. It explains the process of exporting CloudWatch metrics to Prometheus via the YACE exporter, which allows for a unified view of infrastructure metrics. The text details the workings of Amazon SQS, emphasizing the importance of monitoring key metrics such as visible, invisible, delayed, and dead-letter queue messages to manage performance and address potential bottlenecks. The setup involves deploying the YACE exporter in a Kubernetes cluster, configuring AWS IAM policies, and integrating with Prometheus to scrape metrics. Additionally, it covers creating alerts for various scenarios, like high message queue numbers or recurring empty receives, to optimize infrastructure costs and performance. The post concludes by highlighting the ability to monitor SQS alongside other cloud-native infrastructure and encourages trying Sysdig Essentials for enhanced monitoring capabilities.

MITRE ATT&CK's defense evasion techniques are strategies used by attackers to bypass security measures, and understanding them is crucial for securing infrastructure. The article explains how these techniques are grouped within the MITRE ATT&CK framework and highlights the role of Falco, an open-source runtime threat detection tool, in identifying such threats in container environments. Falco can detect changes to setuid or setgid bits on files and attempts to disable security tools like ufw, AppArmor, and SELinux, thereby enhancing security by monitoring for abnormal behavior in real-time. The article also discusses how attackers might exploit elevation control mechanisms or disable security tools to gain unauthorized access or maintain persistence, illustrating the necessity of runtime security tools like Falco to protect containerized applications.