September 2022 Summaries

In September 2022, Sysdig introduced a range of new features and updates across its Monitor and Secure platforms. Notably, Sysdig Monitor now includes a Google Chat Channel Integration, a Stacked Bar Time Chart for visualizing sporadic metrics, and case-sensitive filtering aligning with Prometheus. Sysdig Secure announced custom OPA-based policies for Cloud Security Posture Management, new Falco rules, and insights for hosts and containers, enhancing threat detection and security management. The release also highlights updates to various tools and SDKs, such as the Sysdig CLI and Python SDK, alongside a technical preview of the CSPM Control Library in Actionable Compliance. Sysdig's September update reflects a focus on improving cloud-native security features, enhancing integrations, and providing resources for monitoring and compliance, all while continuously addressing vulnerabilities and refining user experience.

Sysdig has launched the Partner Sales Account Executive (AE) Accreditation Program as part of its channel-first business strategy, which emphasizes transactions through trusted channel partners. This program aims to enhance the sales enablement and education of both existing and new partner sales teams by providing comprehensive training on Sysdig solutions in cloud and container security. It includes insights into market opportunities, target buyer personas, use cases, and unique selling points, equipping sales executives to better understand and advise on security solutions. By becoming accredited, partner AEs can position themselves as trusted advisors and thought leaders, enhancing their ability to address customer challenges and strengthen security postures, ultimately driving partner opportunities and win rates.

The Sysdig 2022 Cloud-Native Threat Report highlights the growing and evolving threats in cloud environments as the use of containers and cloud services expands. The report reveals that threat actors are increasingly targeting cloud infrastructure due to its scalability and complexity, often exploiting misconfigurations and unpatched vulnerabilities to conduct profitable activities like cryptomining. TeamTNT is identified as a notable cryptomining group, demonstrating how a single attacker can inflict significant financial damage on victims. Furthermore, the report discusses the prevalence of supply chain attacks through public repositories like Docker Hub, where threat actors distribute malicious container images. The geopolitical impact of cyberwarfare is also examined, particularly in light of the Russia-Ukraine conflict, which saw a surge in distributed denial-of-service (DDoS) attacks facilitated by easily accessible Docker containers. The report underscores the need for enhanced visibility and security measures in cloud and container environments to effectively mitigate these threats.

Eduardo Mínguez's blog post outlines the process of scanning container images for vulnerabilities using Sysdig Secure with GitHub Actions, emphasizing the importance of integrating security measures early in the CI/CD pipeline. The article provides a step-by-step guide for setting up an image scanning workflow, detailing the use of the sysdig-cli-scanner tool to identify known vulnerabilities and validate container configurations before deployment. It stresses the role of GitHub Actions in automating software development tasks and highlights the benefits of image scanning, such as faster issue detection and prevention of vulnerabilities in production. The post also touches on the customization of scanning policies and the use of caching to optimize workflow efficiency. Integration with Sysdig Secure allows for ongoing policy enforcement and reevaluation of vulnerabilities as new threats emerge, providing a robust framework for maintaining container security standards.

Sysdig Monitor is a tool used for monitoring OpenShift environments, offering features that enhance security through continuously updated, expert-written Falco Feeds. These feeds are designed to help open-source-focused companies stay ahead of emerging threats by providing the latest security rules. By integrating these feeds, Sysdig Monitor enables organizations to better defend their cloud environments and maintain robust security practices, with the option to test drive the system under the guidance of a security expert.

Kubernetes Pod eviction is a process where Pods are terminated due to insufficient resources, primarily resulting from preemption and node-pressure scenarios. Preemption occurs when a high-priority Pod needs to be scheduled, prompting the eviction of lower-priority Pods to make room, managed through Pod Priority Classes. Node-pressure eviction happens when a node's resources, like CPU or memory, are strained, causing the kubelet to evict Pods based on Quality of Service (QoS) Classes, which prioritize Guaranteed, Burstable, and BestEffort Pods. Additional eviction methods include API-initiated eviction, taint-based eviction, and node drain, which allow for more controlled resource management. Monitoring tools like Prometheus can track these evictions, and proper configuration of resources can lead to cost savings and improved system reliability.

The blog post authored by Eduardo Mínguez outlines the process of using Sysdig's vulnerability scanning tool within Azure Pipelines to identify and rectify vulnerabilities in container images before deployment. The article provides a detailed guide on setting up a pipeline using Azure DevOps, which automates tasks like testing, building, and scanning container images when changes are made to a GitHub repository. It emphasizes the benefits of performing vulnerability scans locally using the sysdig-cli-scanner tool, allowing results to be sent to the Sysdig Secure backend while keeping the images within the user's infrastructure. The blog also highlights the importance of shifting security practices left in the CI/CD process, enhancing the confidence in deploying secure images in production environments. By demonstrating a practical example with a simple Golang application, the article illustrates how to configure Azure Pipelines to build, scan, and store container images, ultimately contributing to improved security and production delivery times.

TeamTNT, a well-known threat actor group, has been targeting cloud and virtual environments like Kubernetes and Docker since 2019, focusing on credential theft and cryptomining. In a recent campaign, they exploited a misconfigured kubelet service in Kubernetes clusters to access pods, download malicious binaries, and execute scripts aimed at stealing AWS credentials and other sensitive data. The attack involved downloading and executing a series of scripts that searched for various credentials, exfiltrating them to TeamTNT's command and control servers. The group is also expanding its focus beyond AWS to other platforms, including GitHub and SSH keys. To mitigate such threats, it is recommended to avoid exposing kubelet services to public networks with anonymous access and to secure credentials properly. Falco, a CNCF incubating project, can help detect these malicious activities in real time by using customizable rules to monitor for anomalies in cloud-native environments.

Kubernetes Security Posture Management (KSPM) is a critical framework for assessing and improving the security of Kubernetes clusters and workloads. It functions as a subset of Cloud Security Posture Management (CSPM), focusing specifically on Kubernetes environments. A key component of KSPM is the ability to continuously monitor and improve security practices by maintaining visibility into the current security posture, prioritizing actions based on risk, and remediating issues at their source. Regular security audits, driven by compliance with industry standards like CIS benchmarks, play a crucial role in identifying vulnerabilities and ensuring that security practices are up-to-date. Automation tools, such as those provided by Sysdig, can streamline the remediation process by integrating with Infrastructure-as-Code (IaC) manifests, thus allowing for efficient management of security violations. This continuous improvement approach ensures that Kubernetes environments remain secure and compliant, rather than rushing to address issues only when audits are imminent.

Infrastructure as Code (IaC) offers a streamlined approach to manage infrastructure by treating it as code, allowing for automation, testing, and version control, but it raises security concerns that are often detected too late in the process. Sysdig addresses these issues by providing tools to scan IaC manifests directly at the source, thereby shifting security measures left to identify and correct vulnerabilities before they propagate through the CI/CD pipeline. This preventive approach is particularly relevant given that many organizations worry about security issues during the runtime phase. Sysdig's integration with popular platforms like GitHub, GitLab, Bitbucket, and Azure DevOps enables seamless workflow incorporation, offering real-time issue identification in pull requests. Additionally, Sysdig Secure facilitates automated remediation by employing benchmarks such as "CIS Kubernetes" and "Sysdig K8s Best Practices," enhancing the security of Kubernetes workloads. Through an example involving a GitOps integration with Sysdig IaC scanning, the text illustrates how security issues can be identified and addressed in the code definition stage, thereby improving the overall security posture of applications managed via IaC.

Sysdig's ToDo solution addresses the pervasive issue of alert fatigue in security and operations by prioritizing actionable recommendations to mitigate security threats efficiently. It is part of Sysdig's Cloud Native Application Protection Platform, designed to help teams focus on the most impactful actions by aggregating similar issues, prioritizing based on risk, and guiding remediation efforts. ToDo identifies critical vulnerabilities and offers strategies for compliance improvement, identity management, and vulnerability prioritization, all aimed at enhancing security posture and preventing lateral movement within cloud environments. The tool leverages deep visibility into system calls and integrates with frameworks like MITRE ATT&CK to help teams quickly identify and address areas of concern, thus improving overall security management.

IBM announced the IBM LinuxONE Emperor 4, a secure and sustainable Linux-based enterprise server, designed to support companies of all sizes in building cyber-resilient systems within hybrid cloud environments. Partnering with Sysdig, IBM offers a unified monitoring and security platform that provides visibility across workloads and infrastructure. This collaboration aims to enhance security, business agility, and sustainability while reducing costs, particularly benefiting industries with strict regulatory requirements like financial services. The partnership leverages open-source technologies to deliver a Kubernetes-based foundation for application development and management. Key features include security governance, vulnerability management, runtime security, continuous compliance, and Prometheus-based monitoring. The ecosystem partnership with IBM enables customers to overcome operational challenges when deploying technologies on cloud-native infrastructure, providing the benefits of open standards, modern DevOps, and popular software applications.

Onna Technologies, a data integration platform, utilizes Snyk and Sysdig alongside Google Cloud to enhance its security posture while saving time and money throughout the software development lifecycle (SDLC). By integrating these tools, Onna achieves comprehensive container security and prioritizes open source security, particularly through Snyk's software composition analysis (SCA) and Sysdig's cloud-native threat detection capabilities. The company emphasizes the importance of shifting security left, which reduces rework and improves efficiency, enabling developers to identify vulnerabilities earlier in the development process. This approach not only strengthens their overall security but also ensures compliance with regulations and customer expectations, providing a competitive edge. The integration of Snyk and Sysdig aims to refine Onna's security strategies further, focusing on prioritization to manage security issues effectively. The collaboration with these tools has been beneficial, offering enterprise-class security and real-time threat detection, while also providing ongoing support and fostering a responsive relationship with the Sysdig team.

AWS Security Groups and Network Access Control Lists (NACLs) are critical components in securing cloud environments, serving as virtual firewalls to control network traffic in Amazon Web Services (AWS). Security Groups operate at the instance level, allowing for stateful control of inbound and outbound traffic, while NACLs work at the subnet level and offer stateless filtering. Both tools are essential for implementing Layer 3 and 4 security measures, with Security Groups allowing only "allow" rules and NACLs permitting both "allow" and "deny" rules. Best practices for managing Security Groups involve limiting port ranges, enabling VPC flow logs, and removing unused groups to reduce misconfiguration risks. The document emphasizes the importance of continuous monitoring and verification of Security Group configurations, recommending Cloud Security Posture Management (CSPM) tools and AWS CloudTrail for tracking changes and maintaining security compliance. Understanding the shared responsibility model is crucial, as cloud security is a joint effort between the provider and the user, with Security Groups being the user's responsibility.

Machine learning (ML) is a collection of statistical techniques that can unlock insights and scale when applied to narrowly scoped problems with large data sets, but it is not a one-size-fits-all solution, particularly in cybersecurity. In security, ML is best used for specific tasks like signatureless malware detection and network anomaly detection, where it complements traditional methods, though it can struggle with false positives and negatives due to its probabilistic nature. While ML can detect anomalies in predictable systems, its effectiveness depends heavily on the quality and quantity of data it is trained on, as well as the stability of the environment. Many organizations misuse the term ML, often conflating it with basic statistical methods, which underscores the importance of integrating ML tools thoughtfully into existing workflows to enhance rather than replace existing systems for optimal efficiency. As demonstrated by Sysdig's ML system for miner detection, ML can be powerful when combined with human analysis to verify and refine its results.