Falco Soars From CNCF Sandbox to Incubation

Falco, Sysdig’s open source project for monitoring container runtimes, left the Cloud Native Computing Foundation’s (CNCF) sandbox today after its Technical Oversight Committee (TOC) voted to advance the project into incubation. The Falco project joins 14 other Incubating projects at CNCF as the first and, so far, only security runtime platform.  Falco, Sysdig’s open source project for monitoring container runtimes, left the Cloud Native Computing Foundation’s (CNCF) sandbox today after its Technical Oversight Committee (TOC) voted to advance the project into incubation. The Falco project joins 14 other Incubating projects at CNCF as the first and, so far, only security runtime platform.  According to a recent CNCF blog post, the Falco community has focused its efforts on making the project easier to adopt since joining the CNCF sandbox. That work includes Falco becoming one of the first open source projects to tap the recently launched Kubernetes Audit Policy, which brings more data to light by creating an additional feed of events to monitor. Falco was also made available in the Google marketplace. The Falco team also released a Falco Operator, which automates day-to-day workflow, and its inclusion in the OperatorHub.io. Moving forward into this new incubation phase,“Falco will focus on moving to an API-first architecture, which enables the community to begin developing integrations with other tools, including Prometheus, Envoy, and Kubernetes.”   Falco taps into the Linux kernel to provide runtime security at the application, file, system, and network levels. This can shorten the detection and response time for container and microservices architectures. It can be linked to other CNCF projects like the Fluentd logging project, Nats streaming and messaging project, and Kubernetes container orchestration project. That linking will allow Falco to take action against security threats, notify an administrator about those threats, and isolate a Kubernetes node. It can also access metadata from a Kubernetes API server to provide more detail on data it received from the Linux kernel. The Falco project is working to deepen those ties into Kubernetes through the addition of Kubernetes audit events as a Falco event source and support for Kubernetes network policy. Containers are short-lived entities designed to execute a specific function over a fairly short period of time. However, a security breach can result in a container running for longer than scheduled, providing access to or dumping out sensitive data running inside of that container. “Runtime security is a critical piece in a cloud-native security story and essential for anyone taking cloud-native security seriously,” said Kris Nova, chief open source advocate at Sysdig, in a prepared statement.  Dealing with containers in a production or runtime environment, however, can be tricky. Analysts have warned against attempting to tamper with those running containers as that can impede the supported application. Instead, they recommend organizations keep their hands off containers in production. This requires a greater focus on securing the content that makes up a running container before that content is distributed or outside of a running container. A number of security firms have noted that basic protocols designed to check on the running status of a container can highlight whether a container deployment has been breached. “Access control and policy enforcement are important prevention techniques, but runtime security is needed to detect threats that evade preventions,” Nova added.   Container ecosystem development continues to progress at a rapid pace, but security challenges persist. Results from Sysdig’s 2019 Container Usage Report found that more than 50% of containers live less than five minutes, meaning successful incident response in Kubernetes is underscored by insight into usage patterns that affords DevOps and security teams enough time to counteract security threats. Enterprise Strategy Group’s recent “Master Survey Results: 2020 Technology Spending Intentions Survey“ found that 66% of cybersecurity professionals expect to have adopted DevSecOps within the next two years. Insight from the 2020 report also found that half of the respondents anticipate consolidation controls adoption for their organization, leveraging suites and platforms procured from a smaller set of vendors.  Doug Cahill, senior analyst and group director covering cybersecurity at Enterprise Strategy Group, noted in the report that security demands shared responsibility, redefining development, security roles, processes, and technology. “Businesses are shifting from product and organizational silos to an integrated and unified approach, with increased involvement of the cybersecurity team,” Cahill explained. “To enable [this] approach, buyers require solutions that secure the build-ship-run lifecycle and the entire technology stack, independent of deployment locality. The most important attributes of products used to secure cloud-native apps include a rich set of pre-deployment capabilities, runtime capabilities, and support across a mix of server workload types, with flexible deployment options.”