January 2023 Summaries

CoreDNS is a flexible DNS add-on for Kubernetes environments, introduced in Kubernetes 1.11 as an alternative to the kube-dns add-on, and is crucial for the seamless operation of Kubernetes clusters by resolving domain names and facilitating IPs for internal and external services and Pods. Monitoring CoreDNS is essential, given its role in DNS service discovery, and can be effectively performed using Prometheus to scrape and analyze metrics like error rates, latency, traffic, and saturation from CoreDNS endpoints. The single-container setup of CoreDNS, as opposed to the three-container kube-dns, resolves several issues, including security vulnerabilities and stub domains for external services. Prometheus configurations allow for monitoring these metrics, and tools like Sysdig Monitor can further streamline the process by providing out-of-the-box dashboards and accelerating troubleshooting. This ensures that Kubernetes infrastructure remains healthy, supporting the proper functioning of applications and services across varied IT architectures.

In January 2023, Sysdig released several updates across its products, focusing on enhancing security features and expanding support for various platforms. Notably, Sysdig Secure achieved General Availability for its Host Scanning and CSPM Compliance features, allowing for more robust vulnerability management and compliance tracking. The update also introduced support for Infrastructure as Code (IaC) scanning of Terraform resources in AWS, alongside improvements in Kubernetes resource scanning. Sysdig introduced enhancements to their agents, such as the new secure_light mode for reduced resource consumption and improved runtime policy scope matching. The company also updated its reporting features, added new feeds for Golang-related vulnerabilities, and resolved several defects related to YAML tab functionality and Prometheus integrations. These updates aim to fortify cloud security and streamline compliance across various cloud environments.

In cloud applications utilizing Kubernetes, managing Out of Memory (OOM) errors and CPU throttling is crucial to resource efficiency and cost control. Both memory and CPU resources in Kubernetes can be managed through setting limits and requests, which help prevent resource starvation and optimize cloud expenses. OOM errors occur when a container exceeds its allocated memory and is terminated, while CPU throttling happens when a container's CPU usage approaches its limit, leading to slowed processing. Monitoring these metrics is essential, with tools like Prometheus and cadvisor providing insights into resource usage and potential issues. Best practices include setting realistic limits to avoid unwanted throttling or process termination and using priority classes to protect vital pods from preemption. Sysdig Monitor offers solutions to optimize resource use, potentially reducing waste by up to 40%, and provides dashboards for identifying underutilized resources in Kubernetes environments.

Sysdig Secure offers a comprehensive approach to vulnerability scanning across the entire application lifecycle, emphasizing the importance of "defense in depth" by integrating automatic scans at various stages, from development to production. This approach helps to minimize vulnerabilities that could compromise security by using a distributed management system that provides centralized governance and real-time feedback for developers. It supports scanning at multiple levels, including developer workstations, CI/CD pipelines, container registries, and runtime environments, utilizing a kernel-level instrumentation to enhance visibility and prioritization of vulnerabilities based on active usage. Sysdig also includes a risk acceptance feature, allowing exceptions for certain vulnerabilities under specific contexts, and offers detailed reporting capabilities to inform security teams about vulnerabilities and their impact across different environments. This ensures a robust security posture by continually verifying and updating the security status of applications, adhering to a zero-trust model.

A recent analysis by the Sysdig Threat Research Team highlights a vulnerability in KSMBD, a Linux kernel server that implements the SMB3 protocol for file sharing. This vulnerability, identified as CVE-2023-0210, involves a heap overflow in the NTLM authentication code, potentially leading to a denial of service through kernel panic. The vulnerability requires prior knowledge of a valid username to exploit and results from an integer underflow that allows an attacker to overflow an allocated heap buffer. Despite the technical complexity and potential severity, the impact may be limited as KSMBD is not enabled by default in most Linux distributions, requiring users to manually configure it. Additionally, exposing SMB ports to the internet is generally discouraged due to security risks, reducing the likelihood of widespread exploitation.

The blog post by Nigel Douglas provides a comprehensive guide on preventing Distributed Denial-of-Service (DDoS) attacks in cloud environments by leveraging tools like CNCF Project Falco and various cloud-native security measures. It highlights the shift from cryptomining to DDoS activities observed by the Sysdig Threat Research Team, emphasizing the importance of detecting early signs of compromise through expert-written rules and plugins specific to cloud providers such as AWS, Azure, and GCP. The article discusses various layers of DDoS attacks, including application-layer (HTTP/s-level), TCP, and UDP/ICMP activities, and stresses the need for robust security practices like rate limiting, multi-factor authentication (MFA), and access control list (ACL) configurations to mitigate brute force and network flooding attacks. It also emphasizes the critical role of monitoring login activities, detecting suspicious connections, and securing APIs to prevent unauthorized access and data exfiltration. The post underscores the importance of using cloud-based DDoS protection services, network monitoring, and threat detection tools like Sysdig Secure to enhance the security posture across cloud infrastructures while providing insights into the evolving nature of DDoS threats in the context of geopolitical conflicts.

Sysdig has been recognized as a leader in Frost & Sullivan's Frost Radar™ for Cloud-Native Application Protection Platforms (CNAPP), highlighting its strong technology and market vision. As organizations increasingly adopt cloud, containers, and Kubernetes, traditional security measures become inadequate, prompting a shift towards integrated CNAPP solutions like Sysdig's, which offers comprehensive security across the application development life cycle. Sysdig's platform is noted for its container security capabilities and its ability to detect runtime and anomalous threats, significantly reducing the urgency of addressing vulnerabilities. With a reported year-over-year growth rate of 144.4% in 2021, Sysdig is positioned as a rapidly growing CNAPP vendor. Its platform, which includes the open-source threat detection tool Falco, provides a unified view of risks across cloud and container environments, enabling users to prioritize and address security issues effectively.