Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 2 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Cloud(Security)Events -- A Lightweight Framework for Security React... Evan Anderson

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: Cloud(Security)Events -- A Lightweight Framework for Security Reactions - Evan Anderson, VMware

With many different sources of security information, making sense of it all can be daunting. CloudEvents is a lightweight standard for recording and routing event information of all types which is easy to extend and supported by a variety of existing tools. In this presentation, Evan will illustrate how CloudEvents can help tie many different security tools together, from proactive supply chain vulnerability notifications to real-time monitoring and reactive data collection. In less than 5 minutes, we’ll show how CloudEvents is useful as a storage format, a data interchange, and as a mechanism for triggering serverless functions to drive remediation of detected issues. In the end, you’ll discover that CloudEvents is not difficult or mysterious, but a helpful tool in the security toolbox for cloud-native practitioners.

A

I'm here to talk a little bit more about how do we get those kinds of Integrations going for not just GitHub but for your Enterprise and for you know, open source software in general.

A

um For those of you who aren't familiar with Cloud events, we'll be talking about that in a moment, but first we're going to talk using some of the terminology from cloud events. What is an event, so they Define an event to be a notification of something having been observed. So it's not a PR was opened. You know the pr being opened happens whether or not you listen for the event, but the event is sort of telling you hey.

A

If you were interested, you could go and listen to this stream of stuff and you could find out all the PRS that are being opened in this repo or something like that. um So the great thing about this is that there's a lot of different systems that produce events. The other awesome thing is that everybody has made up their own formats.

A

um That's not really awesome because it means if you want to interact with GitHub and you want to interact with gitlab and you want to interact with bitbucket and you want to understand, pull requests.

A

You need to write three copies of the same code and as much fun as it is to write three copies of the same code. I've done it enough.

A

um So Cloud events is a cncf project to standardize a simple envelope kind of think of it. Like HTTP for events. You know you walk up to a whole bunch of apis all over the world. They got different bodies, different payloads, but those headers are common. You got common libraries for like assembling a URL and things like that and Cloud events aims to do that and lets you convert things between all the formats that are already out there in the world.

A

It's not going to replace stuff like protocol buffers or Json or Avro, but you can take a record that was written in Avro and mechanically, convert it to Json and put it on a different type of messaging system, for example, or write it to a log or something like that, and there are a bunch of systems already um I linked some at the bottom. Some are cncf projects. Some are other projects um that produce these kinds of events that you might use to react to security issues, um but it's not just about reacting.

A

You can also take advantage of these to be proactive and say: hey, you know, there's a software build I need to initiate a security scan, or you know, hey I scanned this two weeks ago. Should I rescan it. You know. I know it was built two weeks ago. I should you know re-initiate scans on this thing with a newer set of vulnerabilities, and you can also use this. You saw Falco on the previous page. You can use this to discover hey, wait.

A

There were unexpected system calls from this container um and I'm not going to run through the demo here, but Falco did a great series of blog posts with eight different systems that you could integrate through through Cloud events with Falco sidekick. To basically answer solve the problem. There's a pod running in my cluster. It just started a terminal, that's connected to a uh or a a shell. That's connected to an interactive terminal. I would like to delete that pod.

A

You know so. Your attacker comes in pops. Open a shell and delete pod find a different way in open a shelf delete pod, and so you could actually go and play with this. You know with Cube control, exec or you know, build yourself a little web. Shell run it and watch it get shut down.

A

um So these are some examples of actual events. The one on the right is the Falco rule.

A

um The one on the left is from CD events about a deployment you can imagine how both of these are interesting and useful when you're trying to build a picture of your security posture or to react and mitigate things that are happening in your Enterprise I've had to cut down on the content of the payload in both of these cases, they're actually longer than this, but I thought you might want to read them.

A

So this is where I get to my call to action. If you're a vendor who's producing these things generate. Cloud events tell people what's going on um document what those Cloud events look like, so that people can build these. Yes, they're going to be Rube, Goldberg machines, but Rube Goldberg machines are how a lot of Our Lives get done. So don't fear them, don't go wild, but don't fear them um and if you're an end user there's a lot of different places. Where you can do, you can react immediately.

A

I'm sure a lot of people have seen the Lambda that goes in and fixes I am, if you make an oopsie or something like that, you can store these in bigquery or snowflake, or something like that and query over them later. Hey. You know, I wanted to know this incident happened.

A

What else was happening around that time and you can also keep them as audit records long term in something that's really cheap and again, if there's a problem, you can pull them out later and since they're in a standard format, you can stack up a whole bunch of these things and then filter them later.

A

um If they were all different formats, you need to know. Oh this one's Avro and this one's protobuf and this one's Json uh I. Don't really think you'd enjoy writing that parser later.

A

But if you know you can take them all, stick them all in Avro and you know record them off into S3 or something like that. Then um life is pretty good. So um little pitch for those of you who haven't seen Cloud events, it's a short spec. It's like I, don't know 10 pages. Something like that. You can read it real, fast and I, don't know who's next, but.