{"id":7017,"date":"2022-01-26T22:38:07","date_gmt":"2022-01-26T22:38:07","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/26\/runtime-security-receives-major-boost-from-sysdigs-open-source-falco\/"},"modified":"2022-01-26T22:38:07","modified_gmt":"2022-01-26T22:38:07","slug":"runtime-security-receives-major-boost-from-sysdigs-open-source-falco","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/26\/runtime-security-receives-major-boost-from-sysdigs-open-source-falco\/","title":{"rendered":"Runtime security receives major boost from Sysdig\u2019s open-source Falco"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

In 2021, Sysdig Inc.<\/a> published a container security and usage report<\/a> that identified a few troubling findings.<\/p>\n

While a majority of global Sysdig customers were scanning containers before deployment, over half of those containers<\/a> were running as root<\/a>, a user default that provides access to all commands and files on the operating system.<\/p>\n

In addition, more than a fifth of containers were live less than 10 seconds. This underscored the importance of having security tools<\/a> that can provide real-time monitoring for intervals of 10 seconds or less.<\/p>\n

\u201cWe also found that 27% of users have unnecessary root access and 73% of cloud accounts have public S3 buckets,\u201d said Loris Degioanni<\/a> (pictured), founder and chief technology officer of Sysdig. \u201cThis can generate consequences when you make a mistake. As infrastructures and software become more sophisticated and automated, there\u2019s more risks and opportunities for misconfigurations that tend to be more often the source of issues in the cloud.\u201d<\/p>\n

Degioanni spoke with John Furrier<\/a>, host of theCUBE, SiliconANGLE Media\u2019s livestreaming studio, during the AWS Startup Showcase: Open Cloud Innovations<\/a> event. They discussed the challenges of securing IT beyond the datacenter, Sysdig\u2019s technology for continuous threat monitoring, the firm\u2019s ongoing partnership with Amazon Web Services Inc., and the role of the open-source community to combat bad actors in cybersecurity. (* Disclosure below.)<\/em><\/p>\n

Focus on visibility<\/h3>\n

Risks such as those identified in Sysdig\u2019s report highlight the need for a new way of viewing security protection in IT networks. A datacenter running monolithic applications was a castle, with think walls and a single entrance. Today\u2019s cloud infrastructure is wide open, and calls for a different approach to defending critical assets.<\/p>\n

\u201cThe metaphor I like to use is an amusement park,\u201d Degioanni said. \u201cYou have a big area with many important things inside and users and operators that are coming from different entrances that you cannot really block. We cannot build a giant wall around the amusement park; we need people to come in. Getting visibility and doing it in real time is much more important.\u201d<\/p>\n

To provide that visibility, Sysdig created Falco<\/a>, an open-source tool for continuous risk and threat detection across containers, Kubernetes and cloud. Falco, which acts as a kind of \u201csecurity camera\u201d<\/a> for monitoring anomalous behavior, has been downloaded over 30 million times<\/a> and is currently maintained as an open-source project by the Cloud Native Computing Foundation.<\/p>\n

\u201cWith Falco, our open-source runtime security engine, we took key design decisions at the beginning to make sure the engine would be able to support and parse millions of events per second with minimal overhead,\u201d Degioanni said. \u201cEase of deployment and performance were more important goals here. It\u2019s not uncommon for Sysdig to have users of Falco with tens of thousands, hundreds of thousands of machines and sometimes millions of containers.\u201d<\/p>\n

Real-time detection<\/h3>\n

In recent months, Falco has become more closely aligned<\/a> with AWS CloudTrail, a service from the public cloud provider that provides users with controls in compliance and operational risk auditing for AWS accounts.<\/p>\n

\u201cRecently, we announced an extension of Falco to support cloud infrastructure and security by parsing cloud logs like CloudTrail,\u201d Degioanni explained. \u201cIt is a rule engine based on policies that are driven by the community and allow you to detect misconfigurations, attacks and anomalous conditions in your cloud applications. Falco is able to detect if somebody is running a shell in a container or if somebody is downloading a sensitive file from an S3 bucket, all in real-time.\u201d<\/p>\n

Sysdig has also pursued technology to provide a deeper dive into container security. In 2020, Sysdig extended its alliance with AWS to offer what it characterized as the first inline container scanning tool<\/a> for AWS Fargate, an event-driven platform that scales based on application demand for infrastructure support.<\/p>\n

In May, Sysdig unveiled<\/a> new incident response and runtime detection tools for AWS Fargate, which included file integrity monitoring, a key standard<\/a> used in the payment card industry.<\/p>\n

\u201cIt was a project done in cooperation with Amazon so we could have strong runtime security for containers that are running in Fargate,\u201d Degioanni said. \u201cFalco can be used to protect workloads that are running in virtual machines or containers and also the cloud infrastructure.\u201d<\/p>\n

Sysdig\u2019s continued work with Falco and the open-source community represents a notable element in the evolution of enterprise security. As the world\u2019s major companies continue to embrace open-source tools<\/a> for critical applications, the need for security to keep pace becomes infinitely more important.<\/p>\n

Degioanni sees security as a community problem, one in which the solution will come from the strength of the open-source ecosystem.<\/p>\n

\u201cWe are in a war; it\u2019s the good guys versus the bad guys,\u201d Degioanni said. \u201cThe bad guys are coordinated, motivated, sometimes well-funded and well-equipped. We win only if we fight this war as a community. The future of security is going to be open source.\u201d<\/p>\n

Here\u2019s the complete video interview, part of SiliconANGLE\u2019s and theCUBE\u2019s coverage of the AWS Startup Showcase: Open Cloud Innovations<\/a> event. (* Disclosure: Sysdig sponsored this segment of theCUBE. Neither Sysdig nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)<\/em><\/p>\n