February 2023 Summaries

The blog post discusses the alignment of Falco's Cloudtrail rules with the MITRE ATT&CK Framework for Cloud, focusing on the Cloud Matrix. The framework is beneficial for organizations seeking to enhance cloud security by providing a structured overview of potential threats and guidance on defense strategies. Falco, an open-source intrusion detection system, leverages the MITRE ATT&CK framework to improve threat detection, align with industry standards, prioritize security efforts, and enhance user experience. The blog explains how aligning Falco rules with the framework involves understanding tactics and techniques and creating or tagging existing rules to detect these actions. Additionally, the Cloud Matrix offers benefits such as threat awareness, focused security efforts, improved detection, and continual improvement, all contributing to a robust security posture. The blog also highlights examples of rule alignments for various tactics such as initial access, execution, persistence, and more, while encouraging community contributions to extend rule coverage.

In the SCARLETEEL operation, a sophisticated cyberattack was discovered by the Sysdig Threat Research Team, targeting a cloud environment through a compromised Kubernetes container to escalate privileges in AWS and steal proprietary data. The attackers utilized advanced knowledge of AWS mechanics, including EC2 roles, Lambda functions, and Terraform, to execute the attack, which involved credential harvesting, disabling CloudTrail logs to evade detection, and attempting lateral movement across AWS accounts. The attack's complexity highlights vulnerabilities in cloud security, emphasizing the importance of best practices such as using IMDS v2, implementing the principle of least privilege, securing Terraform state files, and maintaining robust monitoring and alerting systems. The discovery led to measures like revoking compromised credentials and tightening security policies to prevent similar incidents, underscoring the necessity of proactive cloud security measures and the adoption of zero trust principles to mitigate risks.

The discussion explores the potential of OpenAI's ChatGPT as a contributor to the open-source project Falco, which focuses on runtime security by monitoring and protecting software systems in real-time. While ChatGPT can provide valuable assistance in generating Falco security rules and offering guidance on rule creation and plugin development, its contributions require validation by experienced users due to possible inaccuracies and limitations in its understanding. ChatGPT's capability to align Falco rules with the MITRE ATT&CK framework demonstrates its utility, yet its ability to autonomously contribute to open-source projects is limited by its inability to create pull requests. Despite these limitations, ChatGPT can serve as a helpful tool for Falco community members in refining security rules and addressing specific framework requirements, although human oversight remains essential to ensure accuracy and relevance in the rapidly evolving cybersecurity landscape.

Prometheus is a widely acclaimed tool for monitoring Kubernetes, but its DIY deployment can be challenging due to the need for additional add-ons and exporters to pull metrics. Sysdig Monitor, a cloud-native observability platform, simplifies this process by providing a managed service that automatically ingests Kubernetes and Prometheus metrics without the need for extra configuration. It integrates seamlessly with Kubernetes, using features like eBPF for enhanced performance and security insights, and offers out-of-the-box dashboards and metric enrichment to correlate data with cloud infrastructure. Sysdig allows for easy installation and rapid deployment, eliminating the complexity of managing Prometheus at scale and offering additional features like cost analysis and event monitoring, making it a comprehensive solution for companies looking to streamline their monitoring processes.

In February 2023, Sysdig introduced several new features and updates across its Secure and Monitor platforms to enhance Kubernetes environment management and security. Sysdig Secure now includes Risk Spotlight reports, highlighting vulnerabilities in running containers, while Sysdig Monitor's Cost Advisor, available in preview for AWS, offers cost allocation insights and optimization recommendations. Enhancements also include improved advisor navigation, custom webhook notification channels, and multi-threshold alerts. The Sysdig Agent has been updated with new defect fixes and support for IPV6 communication, while the Serverless Agent introduces a serverless-patcher for CI/CD integration. Additionally, Prometheus integrations received updates, and new vulnerability fixes were implemented for orchestrator and workload agents. Throughout February, Sysdig also released multiple educational resources, webinars, and tools to aid users in maximizing the performance and security of their cloud-native environments.

OWASP has developed the OWASP Kubernetes Top 10 to address security concerns in Kubernetes environments, highlighting the most common risks such as misconfigurations, lack of visibility, and vulnerability management. This initiative aims to guide security practitioners in understanding and mitigating threats associated with Kubernetes, an open-source system for automating the deployment, scaling, and management of containerized applications. The guide categorizes risks into misconfigurations, inadequate logging and monitoring, and supply chain vulnerabilities, among others, while recommending tools like Falco, Prometheus, and Open Policy Agent for improved security management. It emphasizes the importance of continuous auditing, policy enforcement, and robust role-based access control (RBAC) configurations to prevent unauthorized access and privilege escalation. Additionally, it underscores the need for encryption and proper secrets management to protect sensitive data, advocating for a proactive approach to vulnerability management through regular updates and patching. The document also discusses the integration of security measures across multi-cloud environments, suggesting solutions like service mesh and network policies to enhance network segmentation and control.

Sysdig Monitor offers a comprehensive solution for monitoring and troubleshooting the Kubernetes control plane, which is crucial for maintaining the functionality and performance of Kubernetes clusters. By deploying the Sysdig Agent across cluster nodes, users can automatically collect and visualize metrics from key control plane components such as the Kubernetes API server, scheduler, and CoreDNS, leveraging eBPF for in-depth data collection. Sysdig provides an out-of-the-box experience with dashboards and alerts, enabling quick identification and resolution of issues, as demonstrated in a case study involving the Kubernetes API server and etcd. The platform supports custom metrics and integrates seamlessly with other Kubernetes distributions, such as OpenShift and managed services like EKS, while offering a managed Prometheus service to alleviate concerns about scalability and storage. Sysdig's tools, including the Sysdig Advisor, facilitate efficient troubleshooting by providing insights into complex infrastructure challenges and optimizing resource use, with the option for a free 30-day trial to explore its capabilities.

Cloud monitoring is a multi-phase journey that companies undertake as they adopt cloud technologies to ensure quality of service and cost efficiency. Starting with the "Firefighter" phase, where no monitoring exists and actions are purely reactive, companies progress through stages of increasing sophistication: "Receptionist," focusing on external black-box monitoring; "Gardener," which emphasizes resource allocation like CPU and memory; "Doctor," where internal application metrics are collected for performance tuning; and "Engineer," where custom metrics are integrated into in-house applications for comprehensive oversight. The final phase, "Strategist," involves using these insights for organizational-wide benefits, including cost optimization and service level agreements, engaging departments beyond IT such as finance and legal. This progression underscores the importance of a well-structured monitoring strategy to enhance efficiency and support business objectives.

The 8220 Gang, initially perceived as a group of "script kiddies," has continued to evolve its tactics, techniques, and procedures (TTPs) since its first identification in 2017, primarily to conduct cryptojacking campaigns. Known for adopting and modifying strategies and tools from other cybercriminal groups such as TeamTNT and Rocke Group, the gang has improved its methods to evade detection and enhance persistence. Key developments in their recent campaigns include the use of a forked XMRig variant, PwnRig, and the implementation of new techniques such as using PureCrypter Malware-as-a-Service, shifting command and control (C2) infrastructure, and employing advanced defense evasion tactics like base64-encoded Python scripts. Despite their reputation for unoriginality, the gang's ability to update its approach indicates a growing sophistication, though it still relies heavily on exploiting vulnerable public-facing applications and misconfigurations in cloud environments.

In early 2023, over 2,700 new vulnerabilities were registered in the Common Vulnerabilities and Exposures (CVE) database, posing challenges for developers who face fatigue from continuous vulnerability prioritization. The Sysdig 2023 Cloud-Native Security and Container Usage Report highlights that only 15% of high or critical vulnerabilities with available fixes are in-use at runtime, suggesting that focusing on these can significantly reduce wasted efforts. Despite the widespread adoption of shift-left security strategies, organizations struggle to balance vulnerability management with the rapid pace of software releases. The report emphasizes the importance of prioritizing vulnerabilities based on actual risk, using criteria like fix availability and exploitability, and highlights the role of runtime security in mitigating threats. Java packages are identified as particularly risky, while using lightweight base images like Alpine can reduce the attack surface drastically. The study underscores the gap between awareness of security tools and the maturity of cloud security processes, with supply chain risks and misconfigurations emerging as significant concerns amidst rapid cloud adoption.

The blog post discusses a significant change made to Git's file compression method in June 2022, which was later implemented by GitHub in January 2023, leading to unintended consequences for software supply chain security. The update, intended to improve performance by shifting from the gzip program to an internal gzip-compatible implementation, inadvertently altered file hashes used for integrity checks, impacting security systems reliant on these hashes to detect malicious code insertions. This situation underscores the complex dependencies within software supply chains and the challenges open-source projects face in communicating and coordinating changes. The incident reflects broader concerns about software supply chain risks and the responsibility shared between open-source communities and commercial entities. The post suggests that organizations should proactively monitor upstream changes and integrate continuous validation processes to mitigate such risks, while also highlighting the importance of open-source transparency and community involvement in maintaining secure and resilient software ecosystems.

Prometheus Alertmanager is an open-source tool designed to help engineering teams manage and streamline their alert notifications, thereby mitigating the exhaustion of Alert Fatigue caused by frequent, unprioritized alerts. It offers several features like routing, inhibition, silencing, throttling, grouping, and notification templates to ensure alerts are actionable and structured. Routing directs alerts to the appropriate receivers, while inhibition prevents downstream alerts from cluttering the system. Silencing temporarily suppresses alerts during known events, and throttling customizes renotification intervals to prevent excessive alerts. Grouping consolidates similar alerts for efficiency, and notification templates standardize alerts to include important context. By distilling numerous alerts into a few actionable notifications, Alertmanager allows on-call engineers to focus more on resolving incidents rather than managing alerts. Additionally, Sysdig Monitor offers a managed solution to simplify the maintenance and monitoring of Prometheus Alertmanager for growing organizations.

Sysdig has introduced a new Custom Webhook notification channel within its Monitor service to enhance integration capabilities with third-party services. The previous Webhook implementation had limitations, such as assumptions about HTTP methods and limited customization of headers and body content, which often resulted in compatibility issues with third-party APIs. The Custom Webhook addresses these issues by allowing users to define the exact structure of the payload and integrate dynamic runtime context information using the Sysdig Templating Language, which supports variables related to alerts and events. Additionally, the new feature includes Conditional Logic, enabling users to send different payloads based on alert properties like severity or type. This upgrade allows for a more flexible and powerful integration process, exemplified by a use case demonstrating the integration with an SMS service provider to send alert notifications via SMS. The new Custom Webhook aims to revolutionize users' workflows by offering full control over HTTP requests and facilitating seamless integration with various external services.

The Sysdig 2023 Cloud-Native Security and Usage Report provides insights into how organizations are utilizing and securing cloud and container environments, revealing key trends and challenges. The report highlights significant security risks, noting that 87% of container images have high or critical vulnerabilities, with 85% of these issues having available fixes that are not applied at runtime. It emphasizes the need for better vulnerability prioritization and the reduction of overly-permissive access, as 90% of granted permissions go unused, posing security risks. Additionally, the report discusses cloud cost inefficiencies, with 59% of containers lacking CPU limits and 69% of requested CPU resources going unused, leading to potential overspending of up to 40%. The short life span of containers, with 72% living less than five minutes, underscores the importance of effective incident response and data collection. Overall, the report suggests that while awareness of security tools and methodologies like zero trust is rising, implementation is lagging, and there are significant opportunities for cost optimization and improved security practices.