Upcoming Sysdig Falco TOC Presentation

Michael Ducy

During the next TOC meeting Loris Degioanni and myself are presenting on Sysdig's open source security project, Falco. I wanted to provide a summary of info that can be used to learn more about Falco ahead of that presentation.

What it is: Falco detects abnormal behavior inside containers and container hosts. This includes reading/writing files, network connections, ports listening, process spawned, and more. 

Why you need it: Falco can detect abnormal behavior, or attacks, inside a Cloud Native platform, and trigger action such as killing the offending container, marking a node as tainted, etc. 

TOC Sponsor: Ken Owens

Proposed Level: Sandbox

Community Presentations:

- Kubernetes Runtime Security: What Happens if a Container Goes Bad? - Jen Tong & Maya Kaczorowski:
  Jen and Maya do an excellent job of explaining the problem of runtime security.

Avoiding Tainted Tenant Apps with Staging Gates and Electric Fences - Bret Mogilefsky, 18F
  Cloud.gov explains how they use Falco to evict Cloud Foundry applications that are compromised.

Blog Posts:

Using Falco with an Elasticsearch, Fluentd, Kibana (EFK) stack to collect security events - https://sysdig.com/blog/kubernetes-security-logging-fluentd-falco/

Using Falco with NATS and Kubeless to react to security events - https://sysdig.com/blog/active-kubernetes-security-falco-nats-kubeless/

Deploying Falco with Helm - https://sysdig.com/blog/falco-helm-chart/

Integrate Falco with Google Cloud Security Command Center - https://sysdig.com/blog/falco-gke-kubernetes-security/

Default Falco rule sets for common applications - https://sysdig.com/blog/docker-runtime-security/

I'm happy to answer anyone's questions about Falco and where we want to take the project. We look forward to presenting in a few weeks. 


Join {cncf-toc@lists.cncf.io to automatically receive all group messages.