• Watch
  • Listen
  • Live Stream
Security Weekly
Security Market Validation
  • Listeners
    • Subscribe
    • Insider List
    • Suggest a Guest
  • Shows
    • Paul’s Security Weekly
    • Enterprise Security Weekly
    • Business Security Weekly
    • Application Security Weekly
    • Security & Compliance Weekly
    • Security Weekly News
    • Tradecraft Security Weekly
    • Secure Digital Life
  • Series
    • CISO Stories
    • Getting the Real Work Done in Cybersecurity
  • Webcasts/Trainings
    • Registration
    • On-demand
  • Articles
  • Partners
    • Become a Partner
    • Landing Pages
  • Hosts
  • Company
    • About
    • Careers
    • Contact

Application Security/ Articles/ Attack Surface Mgmt/ Blue Team/ Cloud Security/ Container Security/ DevOps/ Incident Response/ Network Traffic Analysis/ Security Operations

How Cloud Defenders Thwart Attacks Against Resilient Services

Matt Alderman May 4, 2021

The introduction of containers and micro-service architectures have changed the way we develop, deploy, and run our applications.  Not only has this changed application development, but it’s also created some visibility challenges for application security.  Move those applications to the cloud and we only amplify those challenges.  How do we architect our cloud services and applications for security, but also resilience, to thwart attackers?

Let’s start with some of the application challenges.  Where do we collect our security telemetry for the application?  Kubernetes, the container orchestrator, is one source for log data.  The container is also a source, but collecting those logs requires either instrumentation within the container, a privileged container, or a kernel module.  We can also monitor endpoints and network traffic to fill the gaps in log data.

Now, let’s move that application into AWS Fargate.  We lose the privileged container, kernel module, and endpoint, leaving us container instrumentation and network traffic.  Is this enough to protect our application?

We recently interviewed Jeff Deininger, Principal Cloud Security Engineer at ExtraHop, on Enterprise Security Weekly to discuss how cloud defenders can thwart attacks against resilient services, including those running on      AWS Fargate.  Jeff discusses the various deployment options, including sidecar containers and container instrumentation, that allows ExtraHop to gather network telemetry from serverless containerized workloads     .  Once collected, ExtraHop’s native behavior analysis and anomaly detection capabilities are now used to detect attacks.

During the interview, Jeff used a simulated attack to demonstrate how advanced threat detection works with commonplace architectural elements to deny attackers the crucial traction needed to establish a foothold at the beginning of a campaign, leaving attackers feeling like they are inescapably ‘walking on ice’.

To see how ExtraHop and their Network Detection and Response (NDR) capabilities can protect your cloud applications, watch the technical segment on Enterprise Security Weekly here, watch their on-demand webcast, Extending the Enterprise Network for Remote Workers, or visit securityweekly.com/extrahop for more information.

Share this:

  • Click to share on Twitter (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Facebook (Opens in new window)

Related Posts

web-application-firewall-comparison-696x423

Application Security /

Building a More Secure AppDev Process

uptrend line arrows with bar chart in stock market on blue color background

Articles /

Ransomware Damage Claims Driving Insurance Hikes

asm

Attack Surface Mgmt /

How to Prevent Breaches by Protecting Your Attack Surface

‹ Using the ATT&CK Matrix in real-time to understand threats and attacks › Delivering on the Promise of Application Security in the Cloud

About Security Weekly

Security Weekly is the security podcast network for the security community, distributing free podcasts and media since 2005. We connect the security industry and the security community through our security market validation programs.

More Than Just A Sponsor

We view our relationships with the security industry as partnerships, not sponsorships. Security Weekly works closely with each partner to help you achieve your marketing goals and gain traction in the security market. Interested in becoming a partner? Please visit our partnerships page.

Back to Top

Subscribe To The Blog:

RSS feed RSS - Posts

Search

Latest Tweets

Tweets by @secweekly
© Security Weekly 2022
Powered by WordPress • Themify WordPress Themes