Upcoming Sysdig Falco TOC Presentation
During the next TOC meeting Loris Degioanni and myself are presenting on Sysdig's open source security project, Falco. I wanted to provide a summary of info that can be used to learn more about Falco ahead of that presentation.
What it is: Falco detects abnormal behavior inside containers and container hosts. This includes reading/writing files, network connections, ports listening, process spawned, and more.
Why you need it: Falco can detect abnormal behavior, or attacks, inside a Cloud Native platform, and trigger action such as killing the offending container, marking a node as tainted, etc.
TOC Sponsor: Ken Owens
Proposed Level: Sandbox
TOC Presentation: https://docs.google.com/presentation/d/1YZL5v1lyL-S2UPPhYlefHNHQeKL96T2L0XdUULz-gTA/edit
- Kubernetes Runtime Security: What Happens if a Container Goes Bad? - Jen Tong & Maya Kaczorowski:
Jen and Maya do an excellent job of explaining the problem of runtime security.
- Avoiding Tainted Tenant Apps with Staging Gates and Electric Fences - Bret Mogilefsky, 18F
Cloud.gov explains how they use Falco to evict Cloud Foundry applications that are compromised.
Using Falco with an Elasticsearch, Fluentd, Kibana (EFK) stack to collect security events - https://sysdig.com/blog/kubernetes-security-logging-fluentd-falco/
Using Falco with NATS and Kubeless to react to security events - https://sysdig.com/blog/active-kubernetes-security-falco-nats-kubeless/
Deploying Falco with Helm - https://sysdig.com/blog/falco-helm-chart/
Integrate Falco with Google Cloud Security Command Center - https://sysdig.com/blog/falco-gke-kubernetes-security/
Default Falco rule sets for common applications - https://sysdig.com/blog/docker-runtime-security/
I'm happy to answer anyone's questions about Falco and where we want to take the project. We look forward to presenting in a few weeks.