Loris Degioanni - Practical Cloud Native Security with Falco: Risk and Threat Detection for Containers, Kubernetes, and Cloud. Early Release

by Loris Degioanni and Leonardo Grasso

Copyright 2022 OReilly Media, Inc. All rights reserved.

Printed in the United States of America.

Published by OReilly Media, Inc. , 1005 Gravenstein Highway North, Sebastopol, CA 95472.

OReilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://oreilly.com). For more information, contact our corporate/institutional sales department: 800-998-9938 or corporate@oreilly.com .

• Acquisitions Editor: Jennifer Pollock
• Development Editor: Sarah Grey
• Production Editor: Gregory Hyman
• Copyeditor: Rachel Head
• Proofreader: Kim Wimpsett
• Indexer: WordCo Indexing Services, Inc.
• Interior Designer: David Futato
• Cover Designer: Karen Montgomery
• Illustrator: Kate Dullea

• August 2022: First Edition

See http://oreilly.com/catalog/errata.csp?isbn=9781098118570 for release details.

The OReilly logo is a registered trademark of OReilly Media, Inc. Practical Cloud Native Security with Falco, the cover image, and related trade dress are trademarks of OReilly Media, Inc.

The views expressed in this work are those of the authors, and do not represent the publishers views. While the publisher and the authors have used good faith efforts to ensure that the information and instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work. Use of the information and instructions contained in this work is at your own risk. If any code samples or other technology this work contains or describes is subject to open source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use thereof complies with such licenses and/or rights.

This work is part of a collaboration between OReilly and Sysdig. See our statement of editorial independence.

978-1-098-11857-0

[LSI]

The advent of modern computing stacks is radically changing how we think about security. In the old data center days, security practitioners thought of software applications as medieval castles: securing them involved building big walls with small, well-guarded openings. Modern cloud-based software looks more like a bustling modern city: people move freely inside it and across its limits to consume and provide services and buy, sell, build, and fix things.

As todays urban planners know, big walls and guarded entrances alone are not enough to secure a city. A better approach involves widespread, granular visibility: a network of security cameras, for example, plus the ability to view their footage and react to any threats they capture in real time.

This book is about security for modern applications, using the open source tool that the industry has embraced as the security camera for the cloud native stack: Falco. Falco is a cloud native runtime security project designed to protect software that runs in the cloud by detecting unexpected behavior, intrusions, and data theft in real time. Its the de facto threat detection engine for Kubernetes and for cloud infrastructure, deployed by countless users, from single-machine test environments to some of the biggest computing environments on the planet. Well teach you how you can protect applications as they run by detecting threats and misconfigurations in workloads and in the cloud infrastructure where they operate.

We have a very practical goal in this book: giving you the knowledge you need to successfully deploy runtime security in your environment, regardless of its scale, using Falco. By the time youve finished reading the book, you will have a solid understanding of how Falco works: youll be able to install it in any environment, tune its performance, customize it for your needs, collect and interpret its data, and even extend it.