January 2024 Summaries

Sysdig's January 2024 update introduces several enhancements to its cloud security offerings, highlighting new integrations and features aimed at improving the security and compliance of cloud infrastructure. Notably, Sysdig has been recognized as a leader in the inaugural GigaOM Cloud Workload Security Radar report and has received the DevOps Dozen 2023 award. Key updates include the introduction of Infrastructure as Code (IaC) scanning within the sysdig-cli-scanner tool, a new Inventory feature providing unified data for resource management, and improved vulnerability management through Jira and Splunk integrations. Additionally, Sysdig has launched the Risk Spotlight service for runtime vulnerability management, introduced AI-driven AWS Console login anomaly detection, and expanded its runtime threat detection rules with 31 new rules. Enhancements to existing features include improved role-based access controls, agentless host scanning on AWS EC2, and the ability to auto-remediate AWS Cloud resources through Terraform. Sysdig’s ongoing commitment to innovation in cloud security is further supported by updates to monitoring tools and integrations with Prometheus and Jenkins.

The text explores the evolving landscape of cloud security, emphasizing the critical role of runtime protection in safeguarding cloud-native applications. It highlights the initial focus of many security teams on visibility tools, such as Cloud Security Posture Management (CSPM), which often fail to address actual threats effectively due to limited insight into compute layers like Kubernetes. The author argues that prioritizing runtime security is a more effective strategy, as it provides actionable insights and defense mechanisms that can directly prevent attacks, unlike CSPMs, which primarily generate alerts for developers to address. The narrative underscores the challenges security teams face in adapting to cloud environments and suggests that integrating runtime protection can empower security professionals to take meaningful action in real-time, ultimately enhancing cloud security outcomes.

Public cloud infrastructure has become the standard for launching and scaling businesses, presenting a new attack surface characterized by the aggregate of exploitable IT pathways. While the cloud offers advantages such as built-in logging and easy asset inventory through APIs, it also accelerates the creation of new security gaps as developers expand the attack surface. Efforts to mitigate these risks with strategies like shift-left and zero-trust have proven insufficient, leading to an increased reliance on threat detection and incident response. The concept of a "detection surface" is introduced, which refers to the IT asset types where attacker activity can be detected, varying across different scopes and tools. As developers enhance the cloud attack surface, they also expand the detection surface, creating a need for security operations centers (SOCs) to effectively interpret and act on the data flowing into SIEM systems. Despite the challenges, most security teams are still developing expertise in cloud environments, underscoring the importance of maturing SOC strategies to cover cloud-native software development activities. An upcoming webinar featuring Allie Mellen from Forrester will address these issues, focusing on the future of cloud detection and response.

Sysdig has been recognized as a leader and outperformer in the inaugural GigaOm Cloud Workload Security Radar report, which evaluates the evolving cloud security market. The report emphasizes the necessity for robust, feature-rich platforms that can address complex security needs across cloud infrastructures, containers, hosts, and identities. Sysdig distinguishes itself with its exceptional support for hybrid environments and superior workload detection and response capabilities, further enhanced by the recent integration of generative AI. As cloud security demands the unification of prevention, detection, and response, Sysdig's strategic approach, including its Cloud Attack Graph and advanced AI features, provides organizations with comprehensive real-time detection, prioritization, and risk identification solutions, making it a preferred choice for securing cloud and container environments.

In the blog post, Daniele Linguaglossa explores methods for bypassing the AWS Web Application Firewall (WAF) by leveraging specific DOM events, revealing a vulnerability that was promptly reported and fixed by AWS. The blog details the setup of a test environment using AWS WAF's managed rules to protect web applications from common threats like XSS and SQL injection, highlighting that these rules are not foolproof and require fine-tuning to counter advanced threats effectively. Through manual testing and the development of a custom fuzzer named "Wafer," the team automated the search for unfiltered tags and attributes, uncovering a payload exploiting the experimental onbeforetoggle event to execute arbitrary JavaScript code, thereby bypassing the WAF's defenses. This discovery underscores the importance of continuous testing and adaptation of security measures beyond out-of-the-box solutions to mitigate evolving cybersecurity threats, as demonstrated by the ability of other WAFs like F5 and ModSecurity to block such payloads effectively.