Practical Cloud Native Security with Falco Risk and Threat Detection for Containers, Kubernetes, and Cloud (Loris Degioanni, Leonardo Grasso)（Z-Library）

Page 1

D eg ioa nni & G ra sso Pra ctica l C loud N a tive Security w ith Fa lco Pra ctica l C loud N a tive Security w ith Fa lco Practical Cloud Native Security with Falco Risk and Threat Detection for Containers, Kubernetes, and Cloud Loris Degioanni & Leonardo Grasso

Page 2

WEB OP S “Kubernetes and cloud native are evolving how software is written and run. Security is no exception, and must be approached in a way that follows modern paradigms and best practices. This book will teach you how to do that in a practical, hands-on way.” —Joe Beda cofounder of Kubernetes and coauthor of Kubernetes: Up and Running “Do you run cloud native applications? Care about security? (You should!) This book gives you a mix of architectural knowledge and practical skills and is a great read for both novice and expert.” —Arun Gupta Vice President and General Manager, Open Ecosystem, Intel Practical Cloud Native Security with Falco US $59.99 CAN $74.99 ISBN: 978-1-098-11857-0 Twitter: @oreillymedia linkedin.com/company/oreilly-media youtube.com/oreillymedia As more and more organizations migrate their applications to the cloud, cloud native computing has become the dominant way to approach software development and execution. Protecting modern, cloud native applications from threats requires the ability to defend them at runtime, when they’re most vulnerable to attacks. This practical guide introduces you to Falco, the open source standard for continuous risk and threat detection across Kubernetes, containers, and the cloud. Falco creator Loris Degioanni and core maintainer Leonardo Grasso bring you up to speed on threat detection and show you how to get Falco up and running, plus advanced topics such as deploying Falco in production and writing your own security rules. You’ll learn how to: • Leverage runtime security in cloud native environments • Detect configuration changes and unexpected behavior in the cloud • Protect containers, Kubernetes, and cloud applications using Falco • Run, deploy, and customize Falco • Deploy, configure, and maintain Falco in a production environment • Improve your compliance Loris Degioanni is the CTO and founder of Sysdig. He’s also the creator of sysdig, the popular open source troubleshooting tool, and the CNCF runtime security tool Falco. Loris was an original contributor to Wireshark, the open source network analyzer. Leonardo Grasso is an open source software engineer at Sysdig and a core maintainer of The Falco Project, with a passion for software design and long professional experience in R&D. D eg ioa nni & G ra sso Pra ctica l C loud N a tive Security w ith Fa lco Pra ctica l C loud N a tive Security w ith Fa lco

Page 3

Loris Degioanni and Leonardo Grasso Practical Cloud Native Security with Falco Risk and Threat Detection for Containers, Kubernetes, and Cloud Boston Farnham Sebastopol TokyoBeijing

Page 4

978-1-098-11857-0 [LSI] Practical Cloud Native Security with Falco by Loris Degioanni and Leonardo Grasso Copyright © 2022 O’Reilly Media, Inc. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://oreilly.com). For more information, contact our corporate/institutional sales department: 800-998-9938 or corporate@oreilly.com. Acquisitions Editor: Jennifer Pollock Development Editor: Sarah Grey Production Editor: Gregory Hyman Copyeditor: Rachel Head Proofreader: Kim Wimpsett Indexer: WordCo Indexing Services, Inc. Interior Designer: David Futato Cover Designer: Karen Montgomery Illustrator: Kate Dullea August 2022: First Edition Revision History for the First Edition 2022-08-10: First Release See http://oreilly.com/catalog/errata.csp?isbn=9781098118570 for release details. The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Practical Cloud Native Security with Falco, the cover image, and related trade dress are trademarks of O’Reilly Media, Inc. The views expressed in this work are those of the authors, and do not represent the publisher’s views. While the publisher and the authors have used good faith efforts to ensure that the information and instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work. Use of the information and instructions contained in this work is at your own risk. If any code samples or other technology this work contains or describes is subject to open source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use thereof complies with such licenses and/or rights. This work is part of a collaboration between O’Reilly and Sysdig. See our statement of editorial independ‐ ence.

Page 5

Table of Contents Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Part I. The Basics 1. Introducing Falco. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Falco in a Nutshell 3 Sensors 4 Data Sources 4 Rules 5 Data Enrichment 6 Output Channels 6 Containers and More 7 Falco’s Design Principles 7 Specialized for Runtime 7 Suitable for Production 7 Intent-Free Instrumentation 8 Optimized to Run at the Edge 8 Avoids Moving and Storing a Ton of Data 8 Scalable 8 Truthful 9 Robust Defaults, Richly Extensible 9 Simple 9 What You Can Do with Falco 10 What You Cannot Do with Falco 10 Background and History 10 Network Packets: BPF, libpcap, tcpdump, and Wireshark 11 Snort and Packet-Based Runtime Security 11 iii

Page 6

The Network Packets Crisis 12 System Calls as a Data Source: sysdig 12 Falco 13 2. Getting Started with Falco on Your Local Machine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Running Falco on Your Local Machine 15 Downloading and Installing the Binary Package 16 Installing the Driver 16 Starting Falco 17 Generating Events 18 Interpreting Falco’s Output 21 Customizing Your Falco Instance 23 Rules Files 23 Output Channels 23 Conclusion 25 Part II. The Architecture of Falco 3. Understanding Falco’s Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Falco and the Falco Libraries: A Data-Flow View 31 Drivers 32 Plugins 33 libscap 34 Managing Data Sources 34 Supporting Trace Files 34 Collecting System State 36 libsinsp 37 State Engine 37 Event Parsing 38 Filtering 38 Output Formatting 39 One More Thing About libsinsp 39 Rule Engine 39 Conclusion 40 4. Data Sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 System Calls 41 Examples 43 Observing System Calls 43 Capturing System Calls 47 Accuracy 49 iv | Table of Contents

Page 7

Performance 49 Scalability 49 So What About Stability and Security? 50 Kernel-Level Instrumentation Approaches 50 The Falco Drivers 53 Which Driver Should You Use? 55 Capturing System Calls Within Containers 55 Running the Falco Drivers 56 Kernel Module 56 eBPF Probe 57 Using Falco in Environments Where Kernel Access Is Not Available: pdig 57 Running Falco with pdig 58 Falco Plugins 58 Plugin Architecture Concepts 59 How Falco Uses Plugins 60 Conclusion 61 5. Data Enrichment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Understanding Data Enrichment for Syscalls 63 Operating System Metadata 65 Container Metadata 67 Kubernetes Metadata 69 Data Enrichment with Plugins 73 Conclusion 73 6. Fields and Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 What Is a Filter? 75 Filtering Syntax Reference 76 Relational Operators 77 Logical Operators 78 Strings and Quoting 78 Fields 78 Argument Fields Versus Enrichment Fields 78 Mandatory Fields Versus Optional Fields 80 Field Types 80 Using Fields and Filters 82 Fields and Filters in Falco 82 Fields and Filters in sysdig 83 Falco’s Most Useful Fields 84 General 85 Processes 85 File Descriptors 86 Table of Contents | v

Page 8

Users and Groups 87 Containers 87 Kubernetes 88 CloudTrail 88 Kubernetes Audit Logs 89 Conclusion 90 7. Falco Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Introducing Falco Rules Files 91 Anatomy of a Falco Rules File 93 Rules 93 Macros 95 Lists 96 Rule Tagging 96 Declaring the Expected Engine Version 98 Replacing, Appending to, and Disabling Rules 98 Replacing Macros, Lists, and Rules 99 Appending to Macros, Lists, and Rules 100 Disabling Rules 100 Conclusion 101 8. The Output Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Falco’s Output Architecture 103 Output Formatting 105 Output Channels 106 Standard Output 108 Syslog Output 108 File Output 108 Program Output 109 HTTP Output 109 gRPC Output 110 Other Logging Options 112 Conclusion 113 Part III. Running Falco in Production 9. Installing Falco. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Choosing Your Setup 117 Installing Directly on the Host 118 Using a Package Manager 119 Without Using a Package Manager 122 vi | Table of Contents

Page 9

Managing the Driver 122 Running Falco in a Container 123 Syscall Instrumentation Scenario 124 Plugin Scenario 127 Deploying to a Kubernetes Cluster 127 Using Helm 128 Using Manifests 129 Conclusion 130 10. Configuring and Running Falco. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Configuring Falco 131 Differences Among Installation Methods 132 Host Installation 132 Containers 132 Kubernetes Deployments 133 Command-Line Options and Environment Variables 133 Configuration Settings 134 Instrumentation Settings (Syscalls Only) 134 Data Enrichment Settings (Syscalls Only) 136 Ruleset Settings 137 Output Settings 137 Other Settings for Debugging and Troubleshooting 138 Configuration File 139 Ruleset 140 Loading Rules Files 140 Tuning the Ruleset 141 Using Plugins 142 Changing the Configuration 143 Conclusion 144 11. Using Falco for Cloud Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Why Falco for AWS Security? 145 Falco’s Architecture and AWS Security 146 Detection Examples 147 Configuring and Running Falco for CloudTrail Security 148 Receiving Log Files Through an SQS Queue 148 Reading Events from an S3 Bucket or the Local Filesystem 152 Extending Falco’s AWS Ruleset 153 What About Other Clouds? 154 Conclusion 154 Table of Contents | vii

Page 10

12. Consuming Falco Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Working with Falco Outputs 155 falco-exporter 156 Falcosidekick 157 Observability and Analysis 160 Getting Notified 161 Responding to Threats 161 Conclusion 163 Part IV. Extending Falco 13. Writing Falco Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Customizing the Default Falco Rules 167 Writing New Falco Rules 168 Our Rule Development Method 168 Things to Keep in Mind When Writing Rules 174 Priorities 174 Noise 175 Performance 176 Tagging 178 Conclusion 178 14. Falco Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Working with the Codebase 180 The falcosecurity/falco Repository 180 The falcosecurity/libs Repository 181 Building Falco from Source 181 Extending Falco Using the gRPC API 182 Extending Falco with Plugins 184 Preparing a Plugin in Go 185 Plugin State and Initialization 185 Adding Event Sourcing Capability 187 Adding Field Extraction Capability 189 Finalizing the Plugin 190 Building a Plugin Written in Go 191 Using Plugins While Developing 191 Conclusion 192 15. How to Contribute. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 What Does It Mean to Contribute to Falco? 193 Where Should I Start? 194 viii | Table of Contents

Page 11

Contributing to Falcosecurity Projects 194 Issues 194 Pull Requests 195 Conclusion 197 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Table of Contents | ix

Page 12

(This page has no text content)

Page 13

Preface The advent of modern computing stacks is radically changing how we think about security. In the old data center days, security practitioners thought of software appli‐ cations as medieval castles: securing them involved building big walls with small, well-guarded openings. Modern cloud-based software looks more like a bustling modern city: people move freely inside it and across its limits to consume and provide services and buy, sell, build, and fix things. As today’s urban planners know, big walls and guarded entrances alone are not enough to secure a city. A better approach involves widespread, granular visibility: a network of security cameras, for example, plus the ability to view their footage and react to any threats they capture in real time. This book is about security for modern applications, using the open source tool that the industry has embraced as the “security camera” for the cloud native stack: Falco. Falco is a cloud native runtime security project designed to protect software that runs in the cloud by detecting unexpected behavior, intrusions, and data theft in real time. It’s the de facto threat detection engine for Kubernetes and for cloud infrastructure, deployed by countless users, from single-machine test environments to some of the biggest computing environments on the planet. We’ll teach you how you can protect applications as they run by detecting threats and misconfigurations in workloads and in the cloud infrastructure where they operate. We have a very practical goal in this book: giving you the knowledge you need to successfully deploy runtime security in your environment, regardless of its scale, using Falco. By the time you’ve finished reading the book, you will have a solid understanding of how Falco works: you’ll be able to install it in any environment, tune its performance, customize it for your needs, collect and interpret its data, and even extend it. xi

Page 14

Who Is This Book For? We wrote this book primarily for security operators and architects who want to implement runtime security and threat detection in production in their modern computing environments. However, we’ve designed it to be approachable even for readers with limited or no experience in the field. For that reason, we only require that you have familiarity with the most important cloud computing services, with containers, and with Kubernetes. We’ll also cover more advanced topics like deployment at scale, optimization, and rule writing that even expert users will find useful. So, even if you are familiar with runtime security, and perhaps are already using Falco, this book will help you step up your game. The latter part of the book requires basic knowledge of programming languages like Go. Developers who want to extend or customize Falco will find much value here. Finally, we’ve geared the last chapter of the book toward those who are considering becoming Falco contributors—we hope we’ll inspire you to join them! Overview The book is divided into four parts, organized in order of increasing complexity, with each successive part building on the previous one. To help you get oriented, let’s take a look at the content of each part. Part I: The Basics Part I is about what Falco is and does. Here, we will teach you the fundamental concepts behind Falco and guide you through your first local deployment: • Chapter 1, “Introducing Falco”, gives an overview of what Falco is, including a high-level view of its functionality and an introductory description of each of its components. The chapter includes a brief history of Falco and a look at the tools that inspired it. • Chapter 2, “Getting Started with Falco on Your Local Machine”, guides you through the process of installing a single Falco instance on your local Linux box. The chapter includes instructions on how to run Falco and generate your first notification output. Part II: The Architecture of Falco Part II will teach you about the intricacies of Falco’s architecture and inner workings: • Chapter 3, “Understanding Falco’s Architecture”, dives into the details of Falco sensors, how data collection happens, and what components are involved in xii | Preface

Page 15

processing it. The architectural understanding you will gain from this chapter is the base for the rest of the book. • Chapter 4, “Data Sources”, is about understanding the two main data sources you can use in Falco: system calls and plugins. We explain what the data produced by these sources is, how it is collected, and how Falco’s collection stack compares with alternative approaches. • Chapter 5, “Data Enrichment”, covers techniques Falco uses to enrich the data it collects. Enrichment consists of adding layers of contextual information to the collected data; for example, container IDs, Kubernetes labels, or cloud provider tags. This chapter explains how to configure Falco to collect enrichment meta‐ data and how to customize it to add your own metadata. • Chapter 6, “Fields and Filters”, covers one of the most important concepts in Falco—the filtering engine—and the fields at its base. The chapter is structured as a reference for the language syntax (including operators) and the fields. • Chapter 7, “Falco Rules”, introduces rules and their syntax, including constructs like lists and macros that you will use routinely when customizing Falco. • Chapter 8, “The Output Framework”, describes the mechanism Falco uses to deliver notifications to output channels and the channels available in Falco, and teaches you how to configure and use them. Part III: Running Falco in Production Part III is the reference manual for the serious Falco user. This part of the book will teach you everything you need to know to deploy, configure, run, and tune Falco in any environment: • Chapter 9, “Installing Falco”, presents approaches to installing Falco in produc‐ tion environments, with detailed instructions. • Chapter 10, “Configuring and Running Falco”, covers how Falco’s configuration system works. This chapter will help you understand and use Falco settings, including command-line options, environment variables, the configuration file, and rules files. • Chapter 11, “Using Falco for Cloud Security”, offers a general overview of cloud security, then goes into the specifics of AWS threat detection using Falco’s CloudTrail plugin. It takes a practical approach and includes clear and complete instructions for setting up cloud security in your environment using Falco. • Chapter 12, “Consuming Falco Events”, focuses on what you can do with Falco’s detections. It covers tools that help you work with Falco outputs, like falco- explorer and Falcosidekick, and helps you understand which Falco events are useful to observe and analyze as well as how to process them. Preface | xiii

Page 16

Part IV: Extending Falco Part IV is a reference for developers, covering methods for extending Falco: • Chapter 13, “Writing Falco Rules”, is about customizing and extending Falco’s detections. You will learn how to write new rules and tune existing rules for your needs. In addition to the basics of rule writing, the chapter covers advanced topics like noise reduction, performance optimization, and tagging. • Chapter 14, “Falco Development”, is about working with Falco’s source code. It begins with an overview of the code base, then dives into two important ways of extending Falco: using the gRPC API and the plugins framework. You will find several examples that you can use as the basis for your coding adventures. • Chapter 15, “How to Contribute”, talks about the Falco community and shows you how to contribute to it. It’s ideal reading if, after staying with us for the whole book, you are as excited as we are about Falco! Conventions Used in This Book The following typographical conventions are used in this book: Italic Indicates new terms, URLs, email addresses, filenames, and file extensions. Constant width Used for command-line input and program listings, as well as within paragraphs to refer to commands and program elements such as variable or function names, data types, and environment variables. Constant width bold Shows commands or other text that should be typed literally by the user. Also used occasionally in program listings to highlight text of interest. Constant width italic Shows text that should be replaced with user-supplied values or by values deter‐ mined by context. This element signifies a tip or suggestion. xiv | Preface

Page 17

This element signifies a general note. This element indicates a warning or caution. Using Code Examples Code examples from Chapter 14 are available for download at https://oreil.ly/ practical-cloud-native-security-falco-code. If you have a technical question or a problem using the code examples, please send email to bookquestions@oreilly.com. This book is here to help you get your job done. In general, if example code is offered with this book, you may use it in your programs and documentation. You do not need to contact us for permission unless you’re reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from this book does not require permission. Selling or distributing a CD-ROM of examples from O’Reilly books does require permission. Answering a question by citing this book and quoting example code does not require permission. Incorporating a signifi‐ cant amount of example code from this book into your product’s documentation does require permission. We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN. For example: “Practical Cloud Native Security with Falco, by Loris Degioanni and Leonardo Grasso (O’Reilly). Copyright 2022 O’Reilly Media, Inc., 978-1-098-11857-0.” If you feel your use of code examples falls outside fair use or the permission given above, feel free to contact us at permissions@oreilly.com. O’Reilly Online Learning For more than 40 years, O’Reilly Media has provided technology and business train‐ ing, knowledge, and insight to help companies succeed. Our unique network of experts and innovators share their knowledge and expertise through books, articles, and our online learning platform. O’Reilly’s online learning platform gives you on-demand access to live training courses, in-depth learning Preface | xv

Page 18

paths, interactive coding environments, and a vast collection of text and video from O’Reilly and 200+ other publishers. For more information, visit http://oreilly.com. How to Contact Us Please address comments and questions concerning this book to the publisher: O’Reilly Media, Inc. 1005 Gravenstein Highway North Sebastopol, CA 95472 800-998-9938 (in the United States or Canada) 707-829-0515 (international or local) 707-829-0104 (fax) We have a web page for this book, where we list errata, examples, and any additional information. You can access this page at https://oreil.ly/practical-cloud-native-security- falco. Email bookquestions@oreilly.com to comment or ask technical questions about this book. For news and information about our books and courses, visit https://oreilly.com. Find us on LinkedIn: https://linkedin.com/company/oreilly-media Follow us on Twitter: https://twitter.com/oreillymedia Watch us on YouTube: https://www.youtube.com/oreillymedia Acknowledgments We would like to start by thanking, from the bottom of our hearts, the Falco commu‐ nity: the maintainers who spend countless hours running and growing the project with incredible passion; the contributors, big and small, who make Falco better every day; the adopters and champions who give Falco a chance and provide valuable feedback. Falco, clearly, is the product of your love and talent, and it will be an honor for us if this book can showcase your incredible work. Thanks also to the Cloud Native Computing Foundation, for providing a good home for Falco and supporting its growth. We would like to thank as well the people who helped us and supported us while writing this book: in particular, our project manager, Tammy Yue, and our O’Reilly editor, Sarah Grey. You have been not only very professional and helpful, but also extremely gracious, constructive, and patient. Working with you has been a true pleasure. xvi | Preface

Page 19

Finally, this book would not have been possible without the support of Sysdig, the company where we both work. We truly appreciate working for an organization that not only understands but actively supports open source and that embraces our belief that the future of security is open. Leonardo One day, while I was talking to Loris, he proposed that we should write a book together. So as I’m here, I have to thank him first. Working on this idea with him was one of the most challenging but, at the same time, fun things I’ve done in my life. Shall we do it again? As a first-time author, writing this book has been an incredible new adventure for me that wouldn’t have been possible without the help and love of my family. So, I would like to thank my shining and beloved Ada, who has always supported me and has given me our little Michelangelo. I also want to thank our little boy for waiting in his mommy’s belly until right after his daddy completed writing this book. Together with Ma~ (read “Matilde,” our little kitten who purred next to me while I was writing), they have accompanied me with patience and joy during this journey. Last but not least, I also have to thank my parents, sister, and uncles with all my heart. They have always believed in me, sustained me, and helped me whenever needed. I couldn’t make it through without them, seriously. Loris I would like to thank my wife Stacey, the love of my life, for her patience and undeterred support for what I do. Thank you for not letting me starve, drown, or generally injure myself during the production of this book. I also want to thank my three kids, Josephine, Vincenzo, and August, for bringing happiness to every minute of my life, including the time spent working on this publication. Your frequent questions and interruptions made writing this book more challenging but also much more pleasant. I’m looking forward to reading the books that you will publish when you grow up. I would like to thank my parents for supporting me at (and before) the beginning of my career. I wouldn’t be writing this preface today without the seeds that you planted many years ago and watered with love and generosity. This book would have not been possible without my coauthor, Leo. The two of us had to spend a lot of time together to produce this work, and every minute with him was pleasant, constructive, and fun. Leo, I’m looking forward to spending time with you on more fun and ambitious projects in the future. Preface | xvii

Page 20

(This page has no text content)