February 2024 Summaries

Sysdig's February 2024 update highlights several significant advancements and achievements in cloud security, including the graduation of Falco within the Cloud Native Computing Foundation (CNCF), which underscores the growing importance of runtime security. Key updates include the introduction of Falco Feeds, which provide expert-written, continuously updated rules to address emerging threats, and enhancements to Sysdig Secure with new vulnerability alerting and activity audit features. The update also brings improvements to Sysdig's Terraform Providers, supporting more resource types across AWS, Azure, and GCP, and new runtime resource types for deeper AWS insights. Sysdig Monitor has been upgraded with enhanced alert notifications, and the Sysdig Agent now offers streamlined configuration and optimized performance through adaptive kernel sampling. Furthermore, the release includes updates to various Sysdig tools and SDKs, such as the Python SDK, CLI Scanner, and Terraform Provider, along with the debut of Falco's new VSCode extension.

Container drift detection is crucial for maintaining runtime security in Kubernetes environments, where any change to immutable workloads can indicate potential malicious activity. Falco, an open-source tool, plays a significant role in detecting such unauthorized changes by using system call analysis to identify events like the creation of new executables or unauthorized file modifications. The tool's rules, which include detecting changes from system calls like chmod, are customizable to specific operational environments, allowing for context-aware filters that reduce false positives. Falco Talon enhances these capabilities by providing a no-code response engine that can automatically terminate pods or isolate network requests in response to detected drifts, aligning with the DIE (Detect, Isolate, and Execute) philosophy to minimize security breaches. This proactive approach not only fortifies defenses against threats but also ensures that the security measures are both stringent and contextually relevant, helping organizations maintain the integrity and security of their cloud-native applications while avoiding alert fatigue.

Victor Hernando's article discusses the importance of rapid response to cloud security threats, emphasizing that attackers can exploit vulnerabilities within just ten minutes. To combat this, the 555 Cloud Detection and Response Benchmark, developed by Sysdig in collaboration with Tines, sets a high standard for security teams: detecting threats in five seconds, triaging in five minutes, and initiating a response within another five minutes. The article highlights the partnership between Sysdig and Tines, which integrates Security Orchestration, Automation, and Response (SOAR) tools to handle complex attacks like the sophisticated Scarleteel incident. Tines, a no-code platform, provides workflows that enable security teams to automate responses, significantly reducing the risk and impact of attacks. The partnership allows for seamless integration with various tools and services, enhancing the ability to detect, analyze, and mitigate threats at cloud speed.

Sysdig has been recognized as a Leader and Outperformer in the GigaOm Radar for Container Security due to its innovation and comprehensive feature set, addressing the growing security challenges posed by the rapid deployment and short lifespan of containers. The GigaOm report highlights Sysdig's exceptional performance across evaluation metrics, including its robust runtime protection and data collection capabilities, which effectively prioritize risks and manage system health. The report advises organizations to select container security solutions based on their specific needs, considering factors like ease of use, flexibility, scalability, and compliance, with Sysdig's offerings particularly noted for their ability to provide extensive runtime insights and support for various deployment models.

As cloud applications proliferate, the need for agile development and robust security becomes paramount, prompting the integration of cloud-native application protection platforms (CNAPPs) that offer a unified approach to safeguarding the entire application lifecycle. These platforms provide security teams with comprehensive threat visibility across multi-cloud environments, facilitating a more effective prioritization of real risks, particularly through the use of runtime insights. Such insights allow teams to focus on current, exploitable vulnerabilities, thereby mitigating alert fatigue and ensuring efficient risk management. By distinguishing critical vulnerabilities based on runtime context, CNAPPs enable security practitioners to address genuine threats promptly, thereby aligning cloud security measures with the rapid pace of innovation. This approach not only aids in preventing lateral movement attacks but also ensures that security does not become a bottleneck in the development process, ultimately fortifying the organization's cloud infrastructure against potential threats.

The SSH-Snake is a sophisticated, self-modifying worm discovered by the Sysdig Threat Research Team, designed to exploit SSH credentials on compromised systems for lateral movement across networks. Released in January 2024, it autonomously searches for SSH private keys, modifies itself for efficiency, and propagates without leaving a file footprint, making it challenging to detect through static methods. Unlike traditional SSH worms, SSH-Snake provides greater stealth and configurability, allowing threat actors to map networks comprehensively and exploit vulnerabilities, such as those found in Confluence. Its activity is identifiable by runtime threat detection tools like Sysdig Secure and Falco, which offer real-time alerts and customizable rules to combat such advanced threats. As SSH-Snake continues to spread, with approximately 100 victims at the time of reporting, its evolution underscores the critical need for dynamic security measures to detect and mitigate fileless malware in cloud-native environments.

Nigel Douglas's blog post explores the significant security challenges posed by advanced persistent threats (APTs) and the ephemeral nature of containers, with 70% of containers now lasting less than five minutes, creating windows of opportunity for attackers. The Sysdig Threat Research Team's 2024 report emphasizes the necessity of real-time responses, highlighting tools like Falco and Falco Talon as vital for monitoring and reacting to threats in Kubernetes environments. Falco provides real-time threat detection, while Falco Talon, a response engine, enables proactive defense by terminating compromised workloads to prevent data exfiltration. The post underscores the importance of adopting agile and proactive security measures, integrating these tools to maintain a secure cloud-native ecosystem, and adapting security strategies to keep pace with attackers' rapid adaptability in exploiting short-lived container vulnerabilities.

The article by Jason Andress explores syscall evasion techniques on Linux systems, specifically focusing on the use of bash shell builtins to bypass security monitoring tools that primarily track process execution through the execve() syscall. It highlights how traditional security tools, which rely on monitoring execve() for process execution, may miss activities conducted through bash builtins like read and echo, which can replicate the functionality of external commands without triggering these syscalls. The text emphasizes the complexity and variety of syscalls, illustrating how they can be manipulated to evade detection by using alternative syscalls such as openat() to track file access. Additionally, the article suggests that relying solely on process execution monitoring is insufficient for comprehensive security, advocating for a more nuanced monitoring approach that considers the wide array of syscalls and system interactions. The article is the first in a series that will further explore syscall evasion techniques, with a nod to the potential for similar techniques on Windows systems and the utility of tools like strace for syscall examination.

Cloud security is increasingly critical as over 85% of organizations are expected to adopt a cloud-first strategy by 2025, making cloud environments attractive targets for cybercriminals. The complexity of cloud services, such as SaaS, IaaS, and PaaS, expands the attack surface for organizations, necessitating enhanced security measures. Traditional security tools often fall short in addressing the unique challenges of cloud environments, leading to the development of Cloud-Native Application Protection Platforms (CNAPPs). CNAPPs integrate various security functions into a single platform, providing comprehensive visibility and control over cloud workloads. By incorporating runtime insights, CNAPPs enable organizations to prioritize security threats based on business impact, thereby improving operational efficiency and minimizing risk. This approach allows DevSecOps teams to focus on significant threats without being overwhelmed by alerts, ultimately strengthening an organization's security posture. As cloud security continues to evolve, the integration of CNAPPs and runtime insights is becoming essential for proactive risk management and the protection of cloud infrastructures.

In the rapidly evolving landscape of cloud-native technologies, Kubernetes plays a crucial role in balancing resource management and security, yet many organizations fail to implement best practices, leaving them vulnerable to attacks such as cryptojacking. The Sysdig 2024 Cloud-Native Security and Usage Report highlights that a significant portion of Kubernetes environments lack resource constraints for CPU and memory, prioritizing development agility over security, which can lead to substantial financial losses. By setting resource limits and utilizing tools like Falco for monitoring, organizations can protect against these threats while optimizing resource utilization. The implementation of resource constraints in Kubernetes is not just a security measure but a strategic necessity to prevent attackers from exploiting unlimited resources, thereby ensuring a secure and efficient environment. This practice is essential in addressing the growing trend of cryptomining attacks, as illustrated by the economic imbalance caused by threats like TeamTNT, emphasizing the importance of proactive resource management in maintaining a secure and financially sound cloud-native ecosystem.

Sysdig's integration of Software Bill of Materials (SBOM) into its Cloud-Native Application Protection Platform (CNAPP) strategy enhances security and compliance for cloud-native applications by providing a standardized framework for understanding software composition and dependencies. Utilizing the CycloneDX format, Sysdig enables efficient vulnerability management and compliance auditing by allowing SBOMs to be extracted, stored, and exported via API, facilitating seamless integration with other security tools. This integration reduces resource usage on client systems and simplifies client logic, ensuring up-to-date vulnerability matching and policy evaluations. By offering in-depth component analysis within SBOMs, Sysdig improves transparency in the software supply chain, underscoring its commitment to enhancing cloud-native security.

Sysdig has been recognized as an Overall, Product, and Innovation Leader in the Cloud-Native Application Protection Platform (CNAPP) space by KuppingerCole, highlighting the company's capabilities in cloud security posture management, application security, and container security. CNAPPs are designed to unify disparate cloud security solutions into a single platform, addressing the unique challenges of cloud-native environments such as the ephemeral nature of containers and the need for automated, scalable solutions. Sysdig's multi-layered detection capabilities and open-source approach were noted as key differentiators, and the company's use of runtime insights was specifically praised for helping identify and prioritize vulnerabilities and detect posture drift in real-time. This comprehensive evaluation underscores the importance of CNAPPs in reducing friction between development and security teams and enabling organizations to maintain security at cloud speed without unnecessary risk.

In February 2024, a cybersecurity advisory was issued by the U.S. Cybersecurity and Infrastructure Security Agency and the FBI about the AndroxGh0st malware, which targets cloud credentials stored in Laravel and other high-profile applications. This malware is used by cybercriminals to exploit vulnerabilities such as CVE-2018-15133 and CVE-2017-9841, and it poses significant risks by targeting credentials in .env files, launching phishing attacks through email services, and infiltrating cloud environments. The advisory underscores the importance of implementing security measures like vulnerability management, secrets management, and threat detection to prevent data theft and ransomware attacks. Sysdig provides a solution to these threats by offering runtime security and container-specific rules to detect and respond to suspicious activities in real time. Achieving rapid detection and response, as highlighted by the proposed 5/5/5 benchmark, is crucial for cloud security programs to effectively counteract the speed at which these attacks occur.

With cybersecurity breaches becoming increasingly frequent and impactful, the U.S. Securities and Exchange Commission (SEC) has issued new regulations to standardize the disclosure of material cybersecurity incidents. These rules require companies to disclose such incidents via an 8-K filing within four days, detailing the event's nature, scope, timing, and projected impact, with additional disclosures required in annual reports. Despite not fundamentally altering existing practices, these regulations aim to ensure consistency and transparency in cybersecurity reporting. A panel of experts, hosted by Sysdig's CEO Suresh Vasudevan, emphasized the importance of establishing clear processes for incident escalation and response, assessing materiality with the help of finance and legal teams, and practicing incident response protocols to improve readiness. The ongoing scrutiny from the SEC, exemplified by its lawsuit against SolarWinds for inadequate cybersecurity practices, underscores the necessity for companies to thoroughly understand and comply with these mandates to avoid legal repercussions and enhance their cybersecurity governance.

The evolution of kernel introspection is shifting towards advanced, real-time system activity monitoring directly within the kernel, utilizing technologies like eBPF, particularly in Linux environments with tools such as Falco, Tetragon, and Tracee, which are prevalent in Kubernetes-managed containerized workloads. System calls are crucial for interactions between user-space applications and the operating system's kernel, providing a secure interface for resource management, security, and abstraction. In Linux, eBPF enhances kernel functionality without altering the kernel source code, offering fine-grained control over data flow between kernel and user spaces. Conversely, Windows utilizes Event Tracing for Windows (ETW) and Windows Management Instrumentation (WMI) for monitoring, with eBPF for Windows being an emerging project aimed at bringing Linux's eBPF capabilities to Windows, though it faces compatibility challenges. Despite differences in syscall implementations and monitoring in Linux and Windows, efforts like eBPF for Windows are bridging these gaps, potentially enhancing system security and management in Windows environments.

In a recent announcement, Snyk identified four critical vulnerabilities in Kubernetes and Docker, which could lead to supply chain attacks if exploited by attackers who gain control over Dockerfiles. These vulnerabilities, labeled CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, involve race conditions and flawed validation processes that allow attackers to gain host operating system access, launch denial of service attacks, or escape containers to the host environment. The vulnerabilities highlight specific issues such as improper handling of the WORKDIR command, exploitation of mount and symlink commands, and bypassing security checks in Buildkit. The article provides Falco rules to detect exploitation attempts, emphasizing the importance of updating Docker and Kubernetes software to mitigate these high-severity threats. Falco's detection capabilities, integrated into Sysdig Secure, offer real-time monitoring to safeguard cloud infrastructure against these evolving threats, urging users and developers to be vigilant as Docker poses a risk of unauthorized access to workstations and networks.