March 2021 Summaries

Kubernetes 1.21 introduces a series of enhancements and feature graduations aimed at improving performance, security, and flexibility. The update includes 50 enhancements, with 15 features reaching stable status, 14 existing features receiving improvements, and 19 new features being introduced. Key highlights include the introduction of a Memory Manager to optimize application performance, enhanced scheduling capabilities with nominated nodes and pod affinity selectors, and new downscaling strategies for ReplicaSets. The update also marks the deprecation of Pod Security Policies due to their limitations, with complete removal expected by Kubernetes 1.25. Additionally, new network policy configurations, metrics stability enhancements, and storage capacity tracking have been introduced, alongside advancements in authentication and API machinery. Kubernetes 1.21 continues to evolve with features that cater to a broader range of applications and use cases, enhancing the platform's scalability and manageability.

AWS Foundations CIS Benchmarks provide a compliance standard to enhance cloud security posture in AWS environments by offering prescriptive instructions for configuring services according to industry best practices. These benchmarks address challenges such as cloud misconfigurations and the dynamic nature of AWS environments, offering guidance across seven core categories, including Identity and Access Management, Storage, Logging, Monitoring, and Networking. The latest version, 1.3.0, released by the Center for Internet Security, includes recommendations for controls that ensure security measures like multi-factor authentication, encryption, and restricted access to sensitive data. Sysdig Secure for cloud integrates with these benchmarks to automate compliance assessments, enabling continuous monitoring and detection of cloud misconfigurations and threats, while offering additional capabilities such as runtime detection and image scanning. This alignment with AWS CIS Benchmarks helps organizations maintain robust security, governance, and compliance across their cloud infrastructure.

GCP audit logs are essential tools for tracking cloud infrastructure activities, allowing organizations to detect and respond to threats by validating these logs against security policies. The shared responsibility model in cloud environments necessitates that customers secure their cloud accounts, which are prime targets for cyberattacks. Cloud Audit Logs in Google Cloud Platform (GCP) facilitate cloud threat detection by providing a continuous stream of events that detail all activities in a cloud account. These logs are divided into four types: Admin Activity, System Event, Data Access, and Policy Denied, each capturing different aspects of cloud operations. The article highlights the importance of cloud threat detection as a complement to Compute Workload Protection Platform (CWPP) and Cloud Security Posture Management (CSPM) by providing a more immediate detection of suspicious activity. Sysdig Secure for cloud leverages these logs using Falco rules to detect and respond to security events, offering pre-configured rules that align with compliance standards like MITRE ATT&CK, NIST 800-53, and others. This integration helps in quickly identifying cloud misconfigurations and suspicious activities, ensuring a secure cloud environment.

The blog post discusses the importance of implementing effective threat detection for AWS cloud and container environments, emphasizing the shared responsibility model of cloud security where both AWS and users play roles in safeguarding infrastructure. It narrates a fictional scenario of a security breach initiated by the mishandling of AWS CLI credentials, illustrating various tactics an attacker might use to exploit cloud systems, such as bypassing security protocols, modifying access policies, and compromising container images for cryptomining. To mitigate such risks, the article highlights best practices like enabling MFA for all user access, maintaining strict user permissions, and utilizing AWS tools like CloudTrail and AWS Security Hub for monitoring and alerting on suspicious activities. Additionally, the post showcases how Sysdig Secure for cloud can enhance security posture by providing static configuration analysis, vulnerability scanning, and real-time threat detection, thereby helping organizations proactively manage cloud security and compliance.

Enhancing Amazon S3 security is crucial for preventing data breaches, and this article outlines methods to secure S3 resources using AWS CloudTrail and Falco. The text highlights the importance of setting up proper access controls and audit events to monitor and detect suspicious activities. Misconfigurations, particularly with access control lists, can lead to data being inadvertently exposed, making it essential to manage permissions carefully. AWS CloudTrail allows for logging data events, providing a record of every action on S3 buckets, which can be used for security monitoring. Implementing tools like Sysdig Cloud Connector can help analyze these logs in real-time, using Falco rules to identify abnormal behavior and potential threats. The article emphasizes the shared responsibility between AWS and its users to maintain cloud security and offers practical steps for deploying security tools to safeguard Amazon S3 and other AWS services.

Sysdig's March 2021 update introduces several new features and improvements aimed at enhancing security and usability for their customers. Key highlights include the addition of new compliance standards such as SOC 2 and NIST 800-53 rev4 and rev5 to their compliance dashboards, enabling businesses to maintain up-to-date compliance postures efficiently. The update also unveils a PromQL Query Explorer, designed to simplify the creation of meaningful dashboards and alerts without the need for extensive memorization of metrics and queries. Additionally, Sysdig has introduced Windows container scanning in beta, a UI-based Admission Controller for Kubernetes, and the integration of IBM Cloud Functions for advanced notification routing. The update also improves the scan results UI for better vulnerability management and introduces features like SAML Single Logout for enhanced security governance, alongside several performance optimizations and bug fixes across the platform.

AWS Fargate is a service that simplifies container management by allowing users to run containers without managing servers or EC2 clusters, thereby reducing the complexity of resource management. Security in Fargate is a shared responsibility between AWS and customers, where AWS manages the infrastructure security while customers handle their application-level security. The shared model allows small businesses to benefit from AWS's security measures, such as patching vulnerabilities like Meltdown and Spectre, while customers focus on securing their container images and applications. Threat modeling for ECS Fargate identifies various threat actors, including end users, internal attackers, and privileged attackers, and emphasizes the importance of understanding these threats to develop effective defense strategies. Users are advised to follow best practices, such as maintaining strong passwords, using multi-factor authentication, and enforcing the principle of least privilege. Sysdig Secure offers tools like the Cloud Connector for CloudTrail, which enhances threat detection and response times by providing runtime visibility and a set of pre-written Falco rules, aiding in the management of security events within AWS environments.

Amazon has announced the general availability of ECS Exec, a new feature within Amazon Elastic Container Service (ECS) that allows developers to execute commands directly inside their ECS containers, similar to capabilities in Docker and Kubernetes. This feature facilitates debugging and management tasks but raises security concerns due to potential unauthorized access. To address these concerns, AWS offers fine-grained IAM policies and integration with AWS CloudTrail for monitoring usage. Additionally, Sysdig's security tools, like Falco and Sysdig Secure, provide enhanced security measures by detecting and alerting on suspicious command executions within containers, leveraging out-of-the-box rules to ensure compliance with security standards. These tools are essential for maintaining secure production environments by offering visibility and control over the use of ECS Exec, thereby helping cloud teams manage container security effectively.

"Getting started with PromQL" provides an introduction to Prometheus Query Language (PromQL) and its application in querying data stored in Prometheus' time-series database. The article explains the structure of time-series data, where each time series is associated with a metric name and labels, and describes the four types of metrics: gauges, counters, histograms, and summaries. It outlines how to select and aggregate data using PromQL, employing selectors, arithmetic operators, and functions like rate and predict_linear, to perform complex queries and generate insights. The text also highlights the availability of additional resources, such as a downloadable PromQL cheatsheet, a curated PromQL Library, and a free trial of Sysdig Monitor to enhance the learning and application of PromQL in monitoring systems. These resources are designed to help users understand how to efficiently query and analyze time-series data, ultimately aiding in the effective monitoring of systems like Kubernetes.

CVE-2020-13942 is a critical vulnerability affecting the Apache Unomi open-source application, allowing remote code execution (RCE) by exploiting MVEL and OGNL expression language vulnerabilities in versions prior to 1.5.2. The vulnerability arises due to improper handling of class loading, enabling attackers to execute arbitrary code with the application's privileges through crafted HTTP requests. Apache Unomi, a REST server for managing user profiles, is susceptible to this flaw, echoing past security issues in Apache Struts. The vulnerability is rated as critically severe due to its ease of exploitation and significant impact on confidentiality, integrity, and availability. To mitigate the risk, users are advised to update to version 1.5.2, which includes a patch to disable OGNL by default, improve sandboxing, and sanitize MVEL expressions. Detection and prevention strategies involve using image scanners at various stages of the application lifecycle, such as during builds and deployments, and employing runtime detection tools like Falco to identify and respond to exploitation attempts. Sysdig Secure offers solutions to scan container images and enforce security policies via its Admission Controller and Falco detection engine, providing comprehensive protection against this vulnerability.

Sysdig has introduced the PromQL Explorer for Sysdig Monitor, designed to expedite the process of writing PromQL queries by automatically identifying common labels among different metrics. This new feature allows users to interactively modify PromQL results with visual label filtering, enhancing Sysdig's native compatibility with Prometheus monitoring. The Explorer facilitates the creation of queries that can be used in Dashboards and Alerts, leveraging advanced functions, operators, and Boolean logic inherent to PromQL. By focusing on labels, users can filter and aggregate metrics more effectively, which is crucial when combining multiple metrics with different labels. Future updates will further simplify PromQL queries by integrating Sysdig's ServiceVision™ capability, enriching metrics with Kubernetes and application context without additional instrumentation, thus reducing operational complexity. The PromQL Explorer is being rolled out to users of Sysdig's hosted SaaS service, with plans to extend access to self-hosted customers later in the year.

The blog post explores the concept of privilege escalation within the MITRE ATT&CK framework and discusses how open-source tools like Falco can help detect such security threats in containerized environments. Privilege escalation involves exploiting security flaws to gain higher access permissions within a system, often through misconfigurations or overlooked permissions, and covers 12 techniques, including abuse of elevation control mechanisms, SUID and SGID bits, sudo caching, and world-writable file permissions. Falco, an open-source runtime security tool, plays a crucial role in identifying anomalous activities by monitoring system calls and generating event streams, which can then be used to create specific detection rules. These rules, when mapped to MITRE ATT&CK techniques, enable security teams to enhance threat detection and streamline response processes effectively. The post underscores the importance of proactive security measures and offers insights into using Falco to detect and prevent privilege escalation attacks, as well as highlighting commercial offerings like Sysdig Secure for comprehensive container security.