We have talked a lot about how adding 'runtime context' to static security scans helps reduce alert fatigue & prioritizes security protection & remediation based on a risk f/w. However, we haven't shared what are examples of runtime context that we use to achieve this. More 👇

Deep Packet Inspection

Looking at North-South as well as East-West traffic is important, as well as being able to see encrypted as well as plain text traffic w/i the network. Teams can use this visibility to match emerging threats rulesets as well as modsecurity core rules.

Benefits of DPI in ☁️ include:

A. Comprehensive & granular inspection of network traffic, enabling early detection & prevention of potential threats in real-time.

B. Regulatory compliance by enabling fine-grained control and monitoring of network activity.

Correlated Telemetry Across Different Modalities of System Behavior

Teams must be able to observe and correlate anomalous behavior across filesystems, process & system calls, as well as network traffic, security scans, SBOM, etc.

Benefits of correlation include:

A. Early Detection of Advanced Threats - identify anomalous behavior in one area and able to watch other areas
B. Better Incident Response w/ holistic understanding of events
C. Better Understanding of Dependencies - which enables response

Behavioral Analysis in terms of MITRE

Threat actor events in runtime should be mapped & correlated to various stages of cyber kill chain. These threat actor TTPs allows orgs to understand how exactly a threat actor would move w/i the environment to execute a successful attack

Benefits of Behavioral Analysis include:

A.  Early threat detection and prevention
B.  Improved incident response and mitigation
C.  Reduced risk and enhanced security posture

All of this additional 'runtime context' ultimately allows for the reduction of alert fatigue because it focuses on the continuous threats against a ☁️ env & is able to understand what is actively exploitable based on runtime context. Orgs see a 97% reduction in alerts w/ this

If you want to learn more about how @deepfence's CNAPP implements runtime context to help better your security posture, schedule a demo w/ @ryancsmith2222, our Head of Product today!

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/cQknNPM

'Runtime Context': What is it and Why is it Critical to Your Cloud Security

Good morning! We hope everyone in the security community is ready to tackle challenges of the week.

One of the biggest challenges security & compliance teams will face in 2023 is the exponentially increasing # of CVEs in the wild. Today's 🧵 covers this topic 👇

The Problem: CVEs Increase Faster than Teams Can Fix

a) There are more than 1900 CVEs identified every month on avg.
b) The monthly total will include 270 high-severity and 155 critical vulnerabilities
c) 94% of orgs scanned in 2022 had 1 unencrypted service that was exposed.

The Problem (cont)

d) Most CVEs are exploited within 30 days of public disclosure.
e) RDP is the most commonly scanned protocol & Elastisearch and MongoDB are most commonly found DBs in ransomware exploits.
f) SOC analyst spend 30 hrs per week on avg triaging alerts

If teams don't have the proper skillsets, resources, time or processes within their org, vulnerability management quickly can become a detriment to the security posture! Having the ability to quickly PRIORITIZE & REMEDIATE vulnerabilities is a must for orgs in 2023.

So how can teams implement a proper vulnerability management program in the ☁️ in 2023?

a) Conduct regular vulnerability assessments & scans to identify potential security weaknesses in the cloud environment. Set a schedule by which your team will adhere to clean scan goals.

Proper vuln mgmt (cont)...

b) Prioritize and remediate vulnerabilities based on their risk & impact to the organization's operations & data. Go beyond severity and look at: exploitability, accessibility, impact to business assets, sensitive data analysis, attack vector, etc.

Proper vuln mgmt (cont)...

c) 97% of open source vulnerabilities aren't accessible due to network or application configurations. Filter out the noise of traditional vulnerability scans by overlaying runtime data on the scans (SBOM, netflow, etc.)

Proper vuln mgmt (cont)...

d) Take care in how your org handles scanning - make sure it is continuous vs static point in time, config scans according to what's on asset to ensure efficiency & reduce false positives, and look at configuration risk as well as CVEs.

By implementing these best practices for vulnerability management in the ☁️ in 2023, orgs can hope to keep up with the asymmetrical battles being waged by threat actors and have a proper starting point for defending their cloud environments and the applications w/i those envs.

If you want to learn more about how @deepfence's CNAPP can help you with your vulnerability management strategy and program in 2023, schedule a demo with @ryancsmith2222, our Head of Product

If you like this content, like/RT this post & follow us!

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/qH7mkLn

Best Practices for Vulnerability Management in the Cloud in 2023

Last Friday's 🧵 discussed one of the primary halves of a #CNAPP -- #CSPM. Today, we felt it was only fair to cover the other half of CNAPP -- cloud workload protection (#CWP). Together CSPM + CWP have been united along with a few other key capabilities to secure the cloud!

What is CWP?

Cloud workload protection platforms initially started as a standalone market category before being swallowed up by CNAPP. They looked at visibility & control across the DevOps lifecycle for various types of infra. Some of key features are seen in the graphic!

Depth of visibility and control

Where CSPM is about giving you a breadth of visibility across clouds and services, the CWP side of the house more deeply interrogates traffic and security events at the host level, layering defense-in-depth tactics for detection & protection.

Consolidation of Tools & Multi-Cloud Views

Like CSPM, when these capabilities are implemented as part of a platform approach, they offer significant cost savings & SecOps workflow efficiencies by consolidating tools & focusing on alerts that matter regardless of infra or ☁️!

Automation of Workflows to Streamline IR

CWPPs offer orgs the ability to automate & configure the processing, triage, and correlation of alerts across key technology sets such as AV, FIM, IDS/IPS, etc, which are all part of a holistic view into incidents at the host level.

Remember, at the end CWP is just part of the equation. CWPP must be combine with other core capabilities in the cloud, including adding runtime context, to get true cloud native application protection across their environment in the form of #CNAPP tooling.

To find our more about how Deepfence utilizes #CWPP features as part of its #CNAPP to secure your cloud, schedule a demo w/ our Head of Product @ryancsmith2222 today!

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/McukVYP

Benefits of CWPP as Part of your CNAPP Strategy

A core pillar of Deepfence's #CNAPP is #CSPM. This is a critical feature for managing & detecting deviations from a company's security posture across their #cloud resources.

In today's 🧵, we explore a few key benefits to adopting CSPM as a critical capability in the ☁️!👇

First, what is CSPM?

Cloud security posture management (CSPM) identifies & remediates risk by automating visibility, uninterrupted monitoring, threat detection, & remediation workflows to search for misconfigurations across diverse cloud environments/infrastructure.

Continuous Compliance

CSPM tools can help companies meet regulatory & compliance requirements on a continuous basis by providing visibility into the security posture of their cloud infrastructure and resources and ensuring that policies and configurations are up-to-date.

Centralized Multi-Cloud Management of Security Posture

Let's face it: cloud is complex! CSPM tools provide a centralized platform for managing security policies, configurations, and threat intelligence across an org's multi-cloud infrastructure and various hosting modalities.

Scalability and Elasticity of Policy Management

Since CSPM primarily relies on agentless technology and utilizes API monitoring to determine configuration changes to cloud services, it is a more cloud-native approach to scaling enforcement of security policy across clouds!

Real-Time Threat Detection

With real-time access to cloud APIs, CSPM is able to immediately identify misconfigurations and threat actor activity against those risk points, recommend remediation action, & in some cases automate that action for faster security protections!

Remember, at the end CSPM is just part of the equation. CSPM must be combine with other core capabilities in the cloud, including adding runtime context, to get true cloud native application protection across their environment in the form of #CNAPP tooling.

To find our more about how Deepfence utilizes #CSPM features as part of its #CNAPP to secure your cloud, schedule a demo w/ our Head of Product @ryancsmith2222 today!

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/DQBMZOh

Benefits of CSPM as part of your CNAPP Strategy in the Cloud

Deepfence's #CNAPP platform is being adopted at record rates to secure #kubernetes in the ☁️.

However, regardless of whether you're adopting a CNAPP to protect your ☁️, you need good security hygiene for your infra. Today's 🧵 tackles best practices for #kubernetes security!

Network Segmentation

By using network policies, it is possible to restrict the communication between different parts of the cluster, reducing the attack surface.


Least Privileged Access

All the components in a Kubernetes cluster should run with the minimum necessary privileges to perform their function, to reduce the risk of exploitation of vulnerabilities.

Secrets Management

Kubernetes secrets should be encrypted and stored securely. They can be managed using tools like Hashicorp Vault or Kubernetes own secrets management system.

Image Signing and Scanning

All images used in the cluster should be signed and scanned for vulnerabilities to reduce the risk of running malicious or outdated images.

Proper RBAC Implementations

Using RBAC, it is possible to define fine-grained access control for the different components of the cluster and for users, reducing the risk of unauthorized access.

Regular Backups

Regular backups of the cluster state should be taken to ensure that the cluster can be restored to a known good state in case of data loss or corruption caused by an attack or a failure.

Hopefully some of these best practices put you at a good and equitable starting point to combat the increasing rate of threat actors within Kubernetes environments!

If you like this content, like/RT this post & gives us a follow @deepfence

And as always, if you want a demo of how Deepfence's #CNAPP helps secure #kubernetes from build to production, schedule a demo with @ryancsmith2222, our Head of Product.

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/d5K4dWx

Best Practices for Securing Kubernetes in the Cloud

When evaluating different open source software (OSS) for your security purposes, it is important to ensure that the OSS meets certain compliance & regulatory standards.

Today's 🧵 covers common compliances needed for OSS to be adopted for securing large enterprises. More ⬇️

Data privacy and security regulations

Open source security software must comply with regulations such as HIPAA, PCI-DSS, and GDPR, which set strict standards for protecting sensitive data. Identify which standards are applicable to your industry & hold vendors accountable.

Industry-specific regulations

Depending on the industry, open source security software must comply with specific regulations such as NIST, SOC2, and ISO 27001.

Compliance with internal policies

Some large enterprises have their own internal security policies that open source security software must comply with. This includes standards for software development, testing, and deployment.

Internal policies could include:

a) Vuln mgmt: Large enterprises often require that OS sec software be regularly updated to address known vulnerabilities & have a plan in place to respond to new vulnerabilities.

b) Auditing: Vendors must be able to produce auditable reports.

Internal policies cont..

c) Support & maintenance:  Vendors are required to provide ongoing support & maintenance for open source security software, including bug fixes & security updates.

d) Interoperability -  with existing security systems, tools & processes is a must!

Make sure you have a framework for holding your open source security software vendors accountable to the compliance and regulatory frameworks necessary to keep your business compliant and your sensitive data & applications safe and protected.

If you liked today's 🧵 and want to see more content, like/RT this post & give us a follow @deepfence

And check out our OSS solution, ThreatMapper - https://github.com/deepfence/ThreatMapper

You can read the unrolled version of this thread here: https://typefully.com/deepfence/QslpxSm

Compliance for OSS Security Software

Cloud Native Application Protection Platforms (#CNAPP) are only as good as their ability to be instrumented & operationalized by the #cloudsecurity teams who manage them.

In today's 🧵, we give a shout out to the key players on a ☁️ sec team & how CNAPP can help them succeed!

Cloud Security Architect - Responsible for designing & implementing the overall security strategy for the org's ☁️  environment, they have a deep understand of infra & sec best practices & design secure solutions to meet the orgs app needs!

Architects benefits from CNAPP platforms in a few ways:

a. Understanding the topology of the env they're protecting
b. Building ThreatGraphs of exploitable risk within their env to understand where controls are necessary!
c. Posture management against the environment

Cloud Security Engineer - This role is responsible for the day-to-day management & maintenance of cloud security controls; b/c of this they have experience with #cloudsec tooling & help implement appropriate technology controls in the environment for detection & protection.

Security engineers benefit from CNAPP by:

a. One system to implement security posture across multi-cloud
b. Granular control of protection based on attacker TTP & known bad threat intel
c. One system for detection & protection across Iaas, PaaS, SaaS!

Cloud SecOps Analyst - In charge of monitoring the org's ☁️ environment for security incidents & responding to them. Their experience with security incident response helps to quickly identify and contain threats!

Cloud SecOps Analyst benefits from a CNAPP b/c:

a. Reduce 97% of alerts coming from individual tooling, which saves them 20+ hours of week of manual effort.
b. Allows them to focus on the alerts that matter w/i the env in a timely way to instrument appropriate response!

Cloud Compliance Analyst - They manage & ensure the org's ☁️ env is compliant with relevant regulations & standards such as HIPAA, SOC 2, and PCI-DSS, and implement controls to meet those requirements.

Compliance professionals benefit from CNAPP b/c:

a. CNAPP provides a centralized management console for multi-cloud asset inventory
b. CNAPP provides a singular posture assessment across a multi-cloud env against important regulatory standards. Ensures continuance compliance!

Cloud Sec Manager - Tasked with identifying and assessing risks to the org's security posture, & developing/implementing strategies to mitigate those risks. They need to adopt a risk framework to prioritize spend of sec resources across the env for protection & remediation.

Managers benefit from CNAPP due to:

a. Consolidating costs across disparate security tooling
b. Increased efficiency & ROI from staff
c. Reporting that can highlight risk across business units better centering cost/profit centers w/ their risk posture!

We hope you enjoyed this 🧵. If you enjoyed it, like/RT this post & give us a follow @deepfence!

Want to learn more about how our CNAPP can help you succeed? Schedule a demo w/ @ryancsmith2222, head of product!

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/HUrKGeN

Key Cloud Security Job Roles & How CNAPP Benefits Them

AI & Cloud Security are two hyper-growth industries that not only are foundational to our future but share similarities in the battles going on right now in the industries between open source startups & proprietary incumbents. They're on a collision course that's unavoidable!

Today's 🧵 will explore the importance in the similarities on the open source front and share a few ways in which AI will be utilized to further enhance cloud security and present new challenges that security professionals must overcome. Let's dig in 👇

A battle for Open Source Software (OSS) in AI & Cloud Security is raging daily between startups who fundamentally believe these technologies should be open source first and proprietary incumbents who gatekeep this tech & pursue commercial GTM strategies! The similarities are:

OSS in AI & Cloud

a. Transparency & trust: In AI, open sourcing algorithms allows for the community to understand how decisions are made in order to detect any biases. In ☁️ sec, open sourcing tools allows for the community to have a common baseline for fighting threats!



b. Cost savings fuel innovation: In AI, OSS libraries can save companies from having to develop their own algorithms, which jumpstarts vertical startups in the space. In ☁️ sec, OSS can consolidate expensive proprietary solutions from the 75+ tools on average used.




c. Community development: In AI, there are open source libraries such as TensorFlow and PyTorch that are widely used by a large community of developers. In ☁️ sec, there IS OSS such as ThreatMapper that is used and improved upon by the community.

Beyond the similarities going on for the battle of the heart of OSS in these respective industries, they are on a collision course for one another due to the amplifying effect AI will have on attacks from threat actors & corresponding detection and response efforts in the ☁️!

First, AI can be used to accelerate and exponentially expand the toolkit of threat actors.

a. It can be used to write polymorphic malware - https://www.infosecurity-magazine.com/news/chatgpt-creates-polymorphic-malware/

b. Cybercriminals have already been detected in the wild using it for a # of purposes - https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/

Second, AI can be used for detection & response efforts in the ☁️.

a. It can be used to write steps for remediating compliance configuration issues.
b. Writing detection and response playbooks for SIEM/SOAR
c. Analyzing large stores of threat intel found across dark web



d. Detecting behavioral abnormalities.
e. Modeling behavior of human and machine identities to identify anomalies and inappropriate actions.
f. Modeling the risk surface for exposed assets and assessing vulnerabilities & exposures that might occur due to config changes.

The AI in Cybersecurity Market is estimated to be USD 14.1 Bn in 2022 and is projected to reach USD 41.94 Bn by 2027, growing at a CAGR of 24.36%. The market is HUGE and the industries will collide.

The critical question is whether that future is an open one?

To find out more about how @deepfence supports an open future in ☁️ 🔐 and utilizes AI & ML to improve detection & response, schedule a quick call with our Head of Product, @ryancsmith2222:

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/P6eV7KS

AI & Cloud Security: Two Growing Forces Collide

It's no secret that Deepfence 💙s open source! We have chosen it as our primary GTM route b/c we believe everyone has a fundamental right to ☁️ security!

Today's 🧵 will explore some of the reasons why we think open source models are good for the industry & customers 🧵 👇

Flexibility

Open source models allow for customization & adaptation to specific security needs w/i cloud native infrastructures which are themselves predominately open sources systems. This allows orgs to build tuned sec policy around their brownfield, hybrid ☁️ envs.

Cost-effectiveness

Using open source models can save orgs $, as they do not have to pay for proprietary solutions. The fundamentals of which (vuln mgmt, CSPM, secret scanning, malware detection) should be accessible to all for an equitable playing field in combatting threats


Community-driven development

Open source models benefit from contributions from a large community of developers, which can lead to more robust & secure platforms. Threat intelligence and behavioral detection techniques against MITRE are primed for collective development.

Transparency

With open source models, the source code is available for review & audit, providing greater trust in the security solutions being used. Tech areas such as security, where so much is at stake in terms of privacy & digital assets benefit from this transparency.


Interoperability

Open source models often use open standards, making it easier for different security solutions to integrate. Threat Intel data structures, detection rules, & response playbooks all  examples where open standards help with interoperability between systems.


To read more about Deepfence's reasoning for open sourcing it's cloud native application protection platform, check out our blog post on our Shared Security Model:

https://deepfence.io/introducing-shared-security-model-for-cloud-native/

Remember, as the security community you have the right to demand:

• An equitable starting point for gaining visibility into their attack surface.
• Security tools that scale and support modern application architectures.



• Access to tools that help prioritize risk by exploitability & impact to help alleviate the op resource constraints the industry faces.
• A resilient and robust security ecosystem built by the community, not reliant on any single corporate entity
• Open platforms

As always, if you liked this 🧵, like/retweet & follow us @deepfence.

Or schedule a personal demo with our Head of Product @ryancsmith2222 to learn more about Deepfence's open source platform and approach to security:

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/215wX5H

The Importance of Open Source Models in Cloud Native Security

We talk about the best technologies & strategies to detect and remediate against threat actors within your ☁️ environments but today we wanted to talk about the TOP EXPLOITED CVEs in 2022/early 23 to help your prepare the best mitigation strategies for your hybrid envs 🧵👇

Log4Shell | CVE-2021-44228 - What is It?

It is a remote code execution (RCE) flaw found on Apache Log4j 2 Java logging library. It allows remote attackers to control servers over the Internet.

At discovery, all the versions of Log4j 2 were open to the vulnerability!

Log4Shell | CVE-2021-44228 - Why Care?

a. CVSS 10 - Critical Severity
b. Ubiquitous and widespread nature of vulnerability - present in supply chain everywhere
c. Top Vulnerability linked to China-linked threat actors
d. Widely exploited - 1 million exploits in first 72 hrs

Log4Shell | CVE-2021-44228 - How it Works?


Log4Shell | CVE-2021-44228 - How to Mitigate?

a. Run vuln scan to detect its presence.
b. Overlay runtime information to determine most exploitable machines with open attack vectors and paths.
c. Quarantine hosts where detected in memory
d. Patch - https://logging.apache.org/log4j/2.x/security.html

Runc Container Breakout Vulnerability | CVE-2019-5736 - What is it?

There is a Docker vuln where it’s possible to overwrite the host `runc` binary & obtain root access on the host. When malicious actors have root access, they can escalate their privileges & stage attacks!

Runc Container Breakout Vulnerability | CVE-2019-5736 - Why Care?

a. W/ root control they basically have the 🔑 to the kingdom on that particular server - it could allow lateral spread but also execution of malicious attacks
b. POCs of exploit in circulation

Runc Container Breakout Vulnerability | CVE-2019-5736 - How It Works?

The researchers who revealed the vulnerability discovered that an attacker can trick runC into executing itself by asking it to run /proc/self/exe, which is a symbolic link to the runC binary on the host.

Runc Container Breakout Vulnerability | CVE-2019-5736 - How to Mitigate

RunC has been patched by re-executing a temp copy of itself when it starts. Consequently, /proc/[runc-pid]/exe now points to the temp file, & the runC binary can’t be reached from w/i the container.

Gitlab | CVE-2021-22205 - What is it?

An issue in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser, which resulted in a remote command execution.

Gitlab | CVE-2021-22205 - Why Care?

a. Gitlab has 30 million users
b. CVSS 10 Critical Severity
c. • Anyone able to upload an image that goes through the GitLab Workhorse could achieve RCE via a specially crafted file.

Gitlab | CVE-2021-22205 - How it Works?

With the DjVu annotation, a threat actor with network access to port 443 can transmit an image containing malicious metadata. After, they can execute arbitrary commands on the server as the git user.

Gitlab | CVE-2021-22205 - How to Mitgate?

a. This issue was remediated and patched in the GitLab 13.10.3, 13.9.6, and 13.8.8 release from April 14, 2021 https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/.

b. If you can't upgrade quickly, a hotpatch is available https://forum.gitlab.com/t/cve-2021-22205-how-to-determine-if-a-self-managed-instance-has-been-impacted/60918/2.

In conclusion, we will continue to make 🧵s that highlight threats you should take mitigation action against but best practices are:

a. Update systems
b. Utilize hardware-based MFA
c. Consume threat research to stay ahead
d. Implement CNAPP w/ active runtime protection

If you like this content - like/retweet this 🧵 & follow us @deepfence

Want to see a demo of how Deepfence's CNAPP w/ active runtime protection helps detect & protect against major attacks, schedule a demo w/ @ryancsmith2222, Head of Product,

https://go.deepfence.io/15-minute-demo

You can read the unrolled version of this thread here: https://typefully.com/deepfence/VxjpwZV