How to Use CNCF’s Falco to Protect Yourself From the New SCARLETEEL Attack! by Marat Salakhutdinov @Sysdig

Transcript

1. How to Use CNCF’s Falco to Protect Yourself From the New SCARLETEEL Attack! Marat Salakhutdinov Senior Customer Solutions Engineer at Sysdig
2. Marat Salakhutdinov Senior Customer Solutions Engineer @Sysdig linkedin: https://www.linkedin.com/in/salakhutdinov/ email: marat@sysdig.com
4. Sysdig 2023 Global Cloud Threat Report 1. Cloud Automation Weaponized 2. 10 Minutes to Pain - every second counts 3. A 90% Safe Supply Chain Isn’t Safe Enough 4. Attackers are Hiding Among the Clouds 5. 65% of Cloud Attacks Target Telcos and FinTech
5. SCARLETEEL attack 5
6. “The Security Camera for Modern Apps” created by Sysdig
7. What is Falco? • Runtime security engine • Observability for: ◦ Endpoints ◦ Cloud infrastructure • Built on eBPF • Integrated with Kubernetes CNCF INCUBATED PROJECT
8. Beyond system calls and containers Plugins are dynamic shared libraries which allow Falco to collect and extract fields from streams of events
9. Resources Get started at Falco.org Check out the Falco project in Github Get involved in the Falco community Meet the maintainers on the Falco Slack Follow @falco_org on Join a Falco workshop
10. Demo Environment Details K8S cluster running on an EC2 node (with IMDSv1). • Vulnerable Spring Boot Application • Falco as a daemon set on k8s cluster • Falco Sidekick • Falco Sidekick UI • Falco Cloudtrail plugin • Falco AWS Cloudtrail terraform module An attacker host to execute the infiltration and exploit of the attack. • Rootkit installed. • Other tools to escalate privileges and lateral movement.
11. Demo time 11
12. Is runtime security enough? What helps the attacker to execute the attack: • Vulnerable packages • Vulnerable binaries ◦ In Runtime • Privileged containers • Extensive Permissions • Misconfigurations 12 Vulnerability Management * CSPM / KSPM / CIEM * CNAPP * * - its all can be done by Sysdig CNAPP Platform
13. CNAPP: SCARLETEEL - Sysdig demo lab Features and flows of the Lab: • Runtime Threat Detection and Response • Cloud Threat Detection (AWS account) • Vulnerability Management for K8s workloads • Security Posture ◦ CSPM: Cloud Security Posture Management ◦ CIEM: Cloud Identities and Entitlements Management 13