Sysdig introduces new capabilities to secure Kubernetes-based applications
Sysdig released new features for Sysdig Secure, part of the Sysdig Cloud-Native Intelligence Platform. The Sysdig platform is the unified platform that provides cloud-native security, monitoring, and forensics.
These enhancements add Kubernetes auditing and vulnerability management, service-based access control, and security analytics, along with simplified compliance to give users a view of the health and risk profiles of their container environments.
With the introduction of Sysdig Secure 2.2, Sysdig continues to provide enterprise customers, like Cota Healthcare, Sunrun, and Quby, the ability to detect behavioral anomalies across their entire infrastructure. Sysdig Secure is built on the same core instrumentation as the open source Sysdig project, Falco, which was included as a CNCF Sandbox project in October.
“Modern infrastructures drastically increase the number of moving parts, creating a bigger surface area for attackers to exploit. It can be a nightmare for security professionals, but it doesn’t have to be,” said Knox Anderson, Product Manager, Sysdig. “With the latest features announced today for Sysdig Secure, enterprises have enhanced visibility, answering the questions of, ‘who is doing what within Kubernetes.’”
With the Sysdig Cloud-Native Intelligence Platform, enterprise customers are able to monitor, secure, and troubleshoot without needing to instrument individual containers or configure exporters. By using a single point of instrumentation to unlock a new source of data, Sysdig provides visibility into containers and microservices with the least amount of burden on the environment.
Sysdig Secure 2.2 features
Kubernetes audit events – Adds new detections based on audit data from the Kubernetes API
Sysdig is the cloud-native security provider that taps the recently released Kubernetes Audit Policy, creating an additional feed of events to monitor. Virtually all cluster management tasks are done through the API server; therefore, the audit log contains all changes made to the cluster. By tapping the kube-apiserver, Sysdig can alert administrators of suspicious and notable behavior. These alerts help users identify incidents that could negatively impact the business and lets operators answer who did what, where, and when.
Sysdig teams – Service-based access control
Sysdig Secure 2.2 introduces service-based access control, providing customized reports and dashboards that give users access to only the information that is pertinent to them. The ability to control team privileges to hosts, namespaces, clusters, and deployments, exposes information only to those who need it, making it easier to respond to incidents and adding another layer of security by limiting exposure to information outside the scope of individual teams.
Kubernetes vulnerability management – Admissions controller image validation
Sysdig Secure 2.2 has added the ability to natively integrate with Kubernetes admission controllers. Through mutating webhooks, Kubernetes can authenticate with Sysdig Secure to prevent unscanned or vulnerable images from being deployed on a cluster. This approach allows organizations to validate images at the Kubernetes level rather than container runtime.
Service oriented compliance – Leveraging Kubernetes labels to improve operations and reporting
With the introduction of Kubernetes resource-specific scheduling of CIS Compliance Benchmarks, Sysdig Secure 2.2 further eases the pain of measuring and enforcing compliance across a distributed environment. Scoping enables users to limit scans to Kubernetes resources, which saves time by limiting compliance checks to the logical entities that are important to auditors.
Security analytics – Integrating metrics for a full view
For users who pair Sysdig Monitor with Sysdig Secure 2.2, they have access to more than 90 new metrics that are sent to the Sysdig platform. By viewing Sysdig Secure metrics with the Sysdig Monitor data on the same dashboards, enterprises gain visibility into the performance, health, compliance, and security posture of their environment on a single dashboard.
Sysdig Secure is available as a standalone technology or as a part of the unified Sysdig Cloud-Native Intelligence Platform, which includes Sysdig Monitor. Sysdig Secure 2.2 is available to all customers.