Download to read offline
![Rules
- macro: bin_dir
condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)
- list: shell_binaries
items: [bash, csh, ksh, sh, tcsh, zsh, dash]
- rule: write_binary_dir
desc: an attempt to write to any file below a set of binary directories
condition: bin_dir and evt.dir = < and open_write and not package_mgmt_procs
output: "File below a known binary directory opened for writing (user=%user.name
command=%proc.cmdline file=%fd.name)"
priority: WARNING](https://image.slidesharecdn.com/implementingactivesecuritywithsysdigfalco-181001161011/85/Implementing-Active-Security-with-Sysdig-Falco-Docker-Meetup-Barcelona-13-320.jpg)
Uploaded byNéstor Salceda
Implementing Active Security with Sysdig Falco - Docker Meetup Barcelona
Néstor Salceda, an integrations engineer at Sysdig, discussed implementing active security with Sysdig Falco during a meetup in Barcelona on September 27, 2018. The presentation covered the layers of container security, including vulnerability management, anomaly detection, and behavioral activity monitoring using configurable rules. Salceda emphasized the importance of proactive security measures in the ephemeral container environment and invited contributions to the open-source project.
More Related Content
Similar to Implementing Active Security with Sysdig Falco - Docker Meetup Barcelona
![How Big Brands are Taking Your Traffic in Alberta [Data Inside].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/howbigbrandsaretakingyourtrafficinalbertadatainside-260123180142-42d276f3-thumbnail.jpg?width=640&height=640&fit=bounds)
Implementing Active Security with Sysdig Falco - Docker Meetup Barcelona
- 1. Néstor Salceda, IntegrationsEngineer Docker Barcelona Meetup Sept 27th 2018 Implementing Active Security with Sysdig Falco
- 2. @nestorsalceda • I workat Sysdig • Security and Monitoring passionate • Open Source enthusiast • Daddy of twins • Kubernetes member: Maintainer of Sysdig and Falco Helm charts • Judo, Aikido and other Gendai Budo martial arts lover
- 3. Active Security andResponse Engine CNCF Flavor: NATS & Kubeless approach AWS Flavor: SNS & Lambda approach Layers of Container Security Agenda What is Sysdig Falco?
- 4.
- 5.
- 6. Vulnerability Management: ● UpstreamOS ● Application Vulnerabilities Image / Software Provenance: ● Signed Images / Layers ● Artifact Signing Build
- 7. Secure Secrets Anomaly Detection Forensics Service/ Container Admittance Runtime
- 8.
- 9. • Detects suspiciousactivity defined by a set of rules • Uses Sysdig’s flexible and powerful filtering expressions Behavioral Activity Monitor • Uses Sysdig’s container and orchestrator support Full Support of Containers Orchestration Flexible Notification Methods Open Source Software • Files • STDOUT • Syslog • Execute other programs • And more ... • Welcome contributions • Transparency
- 10. Filter expressions A shellis run in a container container.id != host and proc.name = bash Overwrite system binaries fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin) and write Container namespace change evt.type = setns and not proc.name in (docker, sysdig) Non-device files written in /dev (evt.type = create or evt.arg.flags contains O_CREAT) and proc.name != blkid and fd.directory = /dev and fd.name != /dev/null Process tries to access camera evt.type = open and fd.name = /dev/video0 and not proc.name in (skype, webex)
- 11.
- 12. More rules implementedin draios/falco-extras repository: ● Traefik ● Redis ● Nginx ● PostgreSQL Falco ships with a nice default ruleset for best practices: ● Writing files in bin or etc ● Reading sensitive files ● Terminal spawning in a container Batteries included
- 13. Rules - macro: bin_dir condition:fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin) - list: shell_binaries items: [bash, csh, ksh, sh, tcsh, zsh, dash] - rule: write_binary_dir desc: an attempt to write to any file below a set of binary directories condition: bin_dir and evt.dir = < and open_write and not package_mgmt_procs output: "File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)" priority: WARNING
- 14. Try it out! $helm install --name sysdig-falco-1 --set fakeEventGenerator.enabled=true stable/falco
- 15.
- 16. Breaches may extendfor days or weeks before detected Attacks are changing to abuse activities rather than data exfiltration Ephemeral nature of containers may mean you were breached but may never know Many security paradigms are still reactive Current Security Challenges
- 17.
- 19. Don’t let thatKubeless code spreads in your codebase Command Design Pattern Respect PubSub rules TDD with Playbooks What worked well?
- 20. Talk is cheap, showme the code
- 21.
- 22. Don’t assume anythingfrom your execution environment If you don’ t test your software, your users will do Welcome changes. Even in late phases. Same old story ...
- 23. See it inaction!
- 24. Functions looks likea good fit for react to monitoring events Do not rely on your infrastructure, make it swappable Containers adds more infrastructure, layers and risks. But we have seen them before: DDoS, Injections ... Just a quick summary
- 25.