May 2023 Summaries

Cloud Native Application Protection Platforms (CNAPP) are emerging as comprehensive solutions to address the unique security challenges of cloud environments by integrating previously siloed capabilities such as Vulnerability Management, Cloud Security Posture Management (CSPM), and Cloud Infrastructure Entitlement Management (CIEM). These platforms aim to enhance cloud security by providing real-time detection, compliance validation, and identity management, thereby improving the ability to prioritize and remediate risks across cloud-native applications. CNAPP fosters collaboration between security, DevOps, and cloud teams by consolidating data and insights into a cohesive workflow, allowing for enriched context and more effective threat detection and response. This holistic approach is essential for managing the dynamic and expansive attack surfaces inherent in cloud-native infrastructures.

Victor Hernando's article examines the escalating costs of custom metrics within observability platforms, particularly focusing on the challenge of metric cardinality and its impact on platforms like Datadog and Sysdig. Cardinality, which refers to the number of unique combinations of metric values, can lead to what is known as a cardinality explosion, thereby significantly driving up costs if not managed properly. The article provides a detailed comparison of the pricing models of Datadog and Sysdig, highlighting that Sysdig's pricing is significantly more economical, particularly for businesses managing large volumes of custom metrics. For instance, monitoring 10 million custom metrics can cost $6 million annually with Datadog, whereas Sysdig offers a tenfold cheaper alternative at $600,000. The discussion also includes an example involving Kubernetes clusters to illustrate how metrics costs differ between the two vendors, showcasing that Sysdig not only offers lower costs but also includes additional features at no extra charge. The article underscores the importance of monitoring cardinality growth to prevent unforeseen expenses and suggests that Sysdig provides a cost-effective solution with comprehensive observability features.

Sysdig's risk-based vulnerability management approach addresses the growing number of detected common vulnerabilities and exposures (CVEs) by leveraging Runtime Insights to prioritize vulnerabilities based on their actual usage and risk exposure. This method aims to prevent security teams from becoming overwhelmed by the sheer volume of alerts and helps them focus on mitigating the most critical threats. Sysdig Secure supports this strategy with a trend analysis dashboard that tracks changes in vulnerability metrics over time, providing security teams with essential insights into risk trends and enabling data-driven decision-making to maintain acceptable risk levels. The dashboard facilitates compliance by identifying policy failures and allows for customized filtering to focus on specific namespaces or clusters. Additionally, it offers various reporting tools, such as exporting data and scheduling reports, to demonstrate the impact of security efforts on reducing vulnerability risks. Overall, Sysdig's approach enables more efficient vulnerability management and enhances compliance efforts by continuously reassessing policies and addressing critical vulnerabilities.

Falco is a runtime security tool designed to address common challenges in Day 2 operations by leveraging a rule-based engine that allows for the definition and tuning of security policies to detect and respond to threats in dynamic cloud-native environments. It emphasizes the importance of minimizing noise and false positives in cybersecurity operations, advocating for extensive rule testing and validation in diverse environments before production use. Priority-based filtering in Falco helps security teams focus on critical issues by distinguishing between serious security violations and less critical ones, while leveraging tags aids in reducing noise by routing relevant alerts to specific teams. The tool also supports the customization of rules for different environments, such as staging and production, to account for unique risks and requirements. Performance tuning is crucial given Falco's high-frequency data processing, and strategies include optimizing rule conditions and managing CPU usage. Upgrades and maintenance are streamlined through tools like Helm and Falcoctl, which facilitate automatic updates and rule management, ensuring that Falco remains effective and adaptable in rapidly evolving security landscapes.

Cloud-Native Application Protection Platforms (CNAPP) are designed to secure cloud-native software, which is custom-developed and intended for cloud environments, contrasting with legacy commercial applications. While CNAPP offers a broad set of security features and integrates with various systems, it is not a replacement for traditional tools and is specifically aimed at protecting modern applications and infrastructure in the cloud. Organizations undergoing digital transformation often find themselves needing CNAPP, as it helps secure the software they build rather than what they purchase. Effective CNAPP tools should support a layered defense strategy, addressing security throughout the application's lifecycle, from development to runtime, and require collaboration among diverse team members. The complexity of application-centric security necessitates reducing friction between teams and focusing on aggregated risk management rather than isolated vulnerabilities. As the CNAPP market evolves, organizations should evaluate these platforms based on their specific needs and future development potential, ensuring they effectively address the risks associated with a rapidly changing threat landscape.

Elasticsearch, a widely-used search and analytics engine, offers scalability and redundancy, making it a popular choice for over sixty thousand companies by 2023. Monitoring its performance is crucial, and Prometheus, along with the Elasticsearch exporter, provides a suite of metrics to facilitate this process. Key areas of focus include infrastructure metrics like CPU and JVM memory usage, index performance, and search and cluster performance. The importance of tracking "Golden Signals" such as errors, traffic, saturation, and latency is highlighted for effective monitoring. Tools like PromCat.io and the Elasticsearch REST API enhance the visibility and management of Elasticsearch environments. Additionally, advanced tools such as Java VisualVM and customizable dashboards available through Promcat can be integrated with solutions like Grafana or Sysdig Monitor for more detailed insights.

Loris Degioanni discusses the extension of Falco's capabilities through Falco Feeds, a tool designed to enhance security for open-source-focused companies by providing access to expert-written rules that are regularly updated to address emerging threats.