To meet business objectives,
enterprises are transitioning more and more applications to the cloud.
Modernizing with cloud-native solutions comes with huge benefits.
But doing it right takes time and preparation.
No matter where you are in your cloud journey
adopting a consistent, automated approach
to managing and securing cloud-native and containerized apps
not only helps you ensure smooth operations
it also means you’ll ship cloud applications faster with less risk.
IBM and Sysdig have joined forces with a fully integrated platform
to help enterprises streamline and secure business operations
within and across cloud environments.
We’ve brought together the consistent visibility,
governance and automation of the IBM Cloud Pak for Multicloud Management
with the in-depth container security and compliance of
the Sysdig Secure DevOps Platform
All designed to help you accelerate Kubernetes and cloud adoption
and address security and regulatory compliance
in enterprise hybrid and multi-cloud environments.
IBM Cloud Pak for Multicloud Management
simplifies operating containerized workloads
across clusters and clouds into a single dashboard.
By centralizing security findings, IBM and Sysdig help cloud teams
understand, prioritize, and resolve security issues quickly.
Sysdig extends the depth of security intelligence
available to Cloud Pak for Multicloud Management users
to address security and compliance requirements
across all the stages of the cloud-native lifecycle.
Sysdig’s secure DevOps approach detects and prevents vulnerabilities,
stop threats,
accelerates incident response
and enables in-depth forensics
to help you ship cloud applications faster with less risk.
We’ve made it easy to get started.
Just search for the Sysdig Helm Chart in the IBM Cloud Pak catalog.
You’re provided with a list of prerequisites
and full installation instructions as well as configuration options.
select configure, input a name and a target namespace for the installation.
Here you have the flexibility to choose to deploy across select clusters
or across all of the clusters in any cloud controlled by
the Cloud Pak for Multicloud Management.
Choose the appropriate boxes and in a single workflow
you can install everything you need to get started.
You can also optionally fine tune your agent installation
by configuring various parameters
for example, tolerations for pod placement or things like CPU
and memory limits.
The only required parameter input is the Access Key
from your Sysdig Secure account.
Once this key is entered, select Install and the Sysdig agent
is automatically installed onto your selected clusters.
The integration also features Single Sign On.
This means that once you’ve deployed,
you’ll see the different options to access the Sysdig console directly
from the Cloud Pak for Multicloud Management.
This includes Sysdig Monitor under Monitor Health and Sysdig Secure
in the Administer menu.
Clicking on Sysdig Secure directly opens and logs you in to your account.
Now that everything is installed, you’ll immediately start receiving
runtime security findings detected across your managed clusters.
Let’s go through an example set of events and
the security investigation workflow
using the Cloud Pak for Multicloud Management and Sysdig.
A new Kubernetes service has been created
and we see it here under Applications.
The service - “Bookinfo” - consists of multiple microservices
that are scaled out across different nodes.
If we click over to Govern Risk,
and select Security Findings,
we can see a centralized view of all the governance and risk events
including container runtime security events detected by Sysdig Secure.
The events shown here are classified by severity and also
by applicable compliance and security standards.
We can, for example, filter by severity of medium or higher,
and by PCI and the MITRE ATT&CK compliance & security standards.
One of the security incidents triggered is “Terminal shell in container”
that maps to the MITRE ATT&CK framework.
This type of security event can only be detected using runtime controls.
Security features like image scanning, pod admission control,
or service configuration policies
have NO WAY to flag a terminal session in a running container.
This is a great example of how Sysdig uniquely
extends the security protections that are available
with Cloud Pak for Multicloud Manager.
We can then take a closer look at this incident
by selecting “View finding details.”
Here we get additional information about the event
including relevant container metadata such as cluster, namespace,
pod and container ID where the violation occurred.
We can also get a further description and summary of the event.
This includes details about the user and the command that was executed
in this case BASH
and even the docker image that was in use.
For our example, an administrator
seeing that this is a High Severity security incident
AND that it violates a security policy for the organization
can now choose to perform a deeper security investigation
and generate a forensics report.
Every security finding submitted by Sysdig into
the Cloud Pak for Multicloud Management has an associated backlink
that can be used to drill down into the event for additional data
and to configure remediation actions using the Sysdig Secure interface.
This backlink saves time by keeping the context as we switch screens.
No need to search for the relevant event inside Sysdig Secure
Imagine how much time this will save your team compared
to your current security processes!
Inside Sysdig Secure, we see additional details about
the Terminal Shell in a Container incident and can view the policies
and rules that are configured for this event.
For example, we can click and view the policy
and the rules inside the policy with the runtime conditions.
If we click on edit we can also configure automatic remediation actions,
for example, automatically stopping or pausing the container
and we have the option to create a complete forensics capture
when this event triggers.
Sysdig offers additional capabilities to enable further incident analysis
for a security event.
Even if the “Terminal shell in container” incident happened a week ago
and the affected container is no longer running we can still investigate
and produce a full forensics report.
If we go back to our policy event, we can click on the Activity Audit
and recover all of the activity before, during and after the violation.
This includes file modifications, network connections, interactive processes,
and kubectl exec sessions.
We can zoom in on this incident and, for example,
select commands and network connections.
Here we can see the terminal session and some suspicious commands taking place.
We also see a curl retrieving a script from the internet
and in the last step the attacker attempts to destroy the evidence
by executing shred on the root bash history file.
In just a few steps we now have a deeper understanding of the activity
that took place and can take action to better manage our cloud security risk.
IBM Cloud Pak for Multicloud Management with Sysdig Secure
delivers the only enterprise-ready,
fully integrated cloud management and security solution.
Now you can gain runtime container and Kubernetes insights
to validate compliance, block threats
and investigate security incidents
with full forensics capabilities.
Together IBM and Sysdig provide the control you need
to drive operational efficiency, reduce risk,
and accelerate time to value for private, hybrid,
and multi-cloud environments.
To learn more and get started
visit ibm.com/cloudpaks and sysdig.com/IBM
Thanks for watching.