These Cisco Terms of Use (this “Agreement”) between You and Cisco cover Your use of the Software and Cloud Services (“Cisco Technology”) obtained through this site. The Cisco Technology is intended for use by business users. Definitions of capitalized terms are in Section 11.
You agree to be bound by the terms of this Agreement through (a) Your download, installation, or use of the Cisco Technology; or (b) Your express agreement to this Agreement. If You do not have authority to enter into this Agreement or You do not agree with its terms, do not use the Cisco Technology.
Section 2. Using Cisco Technology
2.1 License and Right to Use. Cisco grants You, for Your direct benefit during the Usage Term and for the full scope of Your Entitlement under this Agreement, a non-exclusive, non-transferable (except with respect to Software as permitted under the Cisco Software Transfer and Re-Use Policy) (a) license to use the Software; and (b) right to use the Cloud Services (collectively, the “Usage Rights”).
2.2 Use by Third Parties. You may permit Authorized Third Parties to exercise the Usage Rights on Your behalf, provided that You are responsible for (a) ensuring that such Authorized Third Parties comply with this Agreement; and (b) any breach of this Agreement by such Authorized Third Parties.
2.3 Free Service. Cisco is making this Cisco Technology available to You without charge, up to certain capacity limits as described in Section 10 below, and subject to the terms of this Agreement. You agree that Cisco, in its sole discretion and for any or no reason, may terminate Your Usage Rights (or any part thereof) and that any termination may be without prior notice and without liability to Cisco. Cisco may, for example, suspend or terminate Your Usage Rights if (i) Cisco has reason to believe that You engaged in any fraudulent behaviour as it relates to the Cloud Services, or (ii) You use Cisco Technology beyond Your Entitlement. You are solely responsible for exporting Your customer data from the Cisco Technology prior to termination, and, except as required by law, Cisco will provide You a reasonable opportunity to retrieve such data.
2.4 Upgrades or Additional Copies of Software. You may only use Upgrades or additional copies of the Software beyond Your Entitlement if You have (a) acquired those rights under a support agreement covering the applicable Software; or (b) You have purchased the right to use Upgrades or additional copies separately.
2.5 Interoperability of Software. If required by law and upon Your request, Cisco will provide You with the information needed to achieve interoperability between the Software and another independently created program, provided You agree to any additional terms reasonably required by Cisco. You will treat such information as Confidential Information.
Section 3. Additional Conditions of Use
3.1 Cisco Technology Generally. Unless expressly agreed by Cisco, You may not (a) transfer, sell, sublicense, monetize, or make the functionality of any Cisco Technology available to any third party; (b) use the Software on second hand or refurbished Cisco equipment not authorized by Cisco, or use Software that is licensed for a specific device on a different device (except as permitted under Cisco’s Software License Portability Policy); (c) remove, modify, or conceal any product identification, copyright, proprietary, intellectual property notices or other marks; (d) reverse engineer, decompile, decrypt, disassemble, modify, or make derivative works of the Cisco Technology; or (e) use Cisco Content other than as part of Your permitted use of the Cisco Technology.
3.2 Cloud Services. You will not intentionally (a) interfere with other users’ access to, or use of, the Cloud Service, or with its security; (b) facilitate the attack or disruption of the Cloud Service, including a denial of service attack, unauthorized access, penetration testing, crawling, or distribution of malware (including viruses, trojan horses, worms, time bombs, spyware, adware, and cancelbots); (c) cause an unusual spike or increase in Your use of the Cloud Service that negatively impacts the Cloud Service’s operation; or (d) submit any information that is not contemplated in the applicable Documentation.
3.3 Evolving Cisco Technology. Cisco may: (a) enhance or modify the features, functionality, and capacity limits of this Cisco Technology at any time, in its sole discretion, without liability; and (b) perform scheduled maintenance of the infrastructure and software used to provide the Cloud Service, during which time You may experience some disruption to that Cloud Service. Whenever reasonably practicable, Cisco will provide You with advance notice of such maintenance. You acknowledge that, from time to time, Cisco may need to perform emergency maintenance without providing You advance notice, during which time Cisco may temporarily suspend Your access to, and use of, the Cloud Service.
Cisco reserves the right (a) to end the life of this Cisco Technology, including component functionality, (“EOL”), and/or (b) to incorporate all or some of the features and functionality of this Cisco Technology into a Cisco paid offer at any time, in its sole discretion, and without liability (“Cisco Offering”). Any new Cisco Offering will be subject to its own terms and conditions.
3.4 Protecting Account Access. You will keep all account information up to date, use reasonable means to protect Your account information, passwords and other login credentials, and promptly notify Cisco of any known or suspected unauthorized use of or access to Your account.
3.5 Use with Third-Party Products. If You use the Cisco Technology together with third-party products, such use is at Your risk. You are responsible for complying with any third-party provider terms, including its privacy policy. Cisco does not provide support or guarantee ongoing integration support for products that are not a native part of the Cisco Technology.
3.6 Open Source Software. Open source software not owned by Cisco is subject to separate license terms as set out at www.cisco.com/go/opensource. The applicable open source software licences will not materially or adversely affect Your ability to exercise Usage Rights in applicable Cisco Technology.
Section 4. Confidential Information and Use of Data
4.1 Confidentiality. Recipient will hold in confidence and use no less than reasonable care to avoid disclosure of any Confidential Information to any third party, except for its employees, affiliates, and contractors who have a need to know (“Permitted Recipients”). Recipient: (a) must ensure that its Permitted Recipients are subject to written confidentiality obligations no less restrictive than the Recipient’s obligations under this Agreement, and (b) is liable for any breach of this Section by its Permitted Recipients. Such nondisclosure obligations will not apply to information that: (i) is known by Recipient without confidentiality obligations; (ii) is or has become public knowledge through no fault of Recipient; or (iii) is independently developed by Recipient. Recipient may disclose Discloser’s Confidential Information if required under a regulation, law or court order provided that Recipient provides prior notice to Discloser (to the extent legally permissible) and reasonably cooperates, at Discloser’s expense, regarding protective actions pursued by Discloser. Upon the reasonable request of Discloser, Recipient will either return, delete or destroy all Confidential Information of Discloser and certify the same.
4.2 How We Use Data. Cisco will access, process and use data in connection with Your use of the Cisco Technology in accordance with applicable privacy and data protection laws. For further detail, please visit Cisco’s Security and Trust Center.
4.3 Notice and Consent. To the extent Your use of the Cisco Technology requires it, You are responsible for providing notice to, and obtaining consents from, individuals regarding the collection, processing, transfer and storage of their data through Your use of the Cisco Technology.
Section 5. Ownership
Except where agreed in writing, nothing in this Agreement transfers ownership in, or grants any license to, any intellectual property rights. You retain any ownership of Your content and Cisco retains ownership of the Cisco Technology and Cisco Content. You acknowledge and agree that any questions, comments, suggestions, ideas, feedback or other information about this Cisco Technology provided by You to Cisco (“Feedback”) are non-confidential and Cisco may use any Feedback You provide in connection with Your use of the Cisco Technology as part of its business operations without acknowledgment or compensation to You.
Section 6. Warranties and Representations
To the extent allowed by applicable law, Cisco expressly disclaims all warranties and conditions of any kind, express or implied, including without limitation any warranty, condition or other implied term as to merchantability, fitness for a particular purpose or non-infringement, or that the Cisco Technology will be secure, uninterrupted or error free. If You are a consumer, You may have legal rights in Your country of residence that prohibit the limitations set out in this Section from applying to You, and, where prohibited, they will not apply
Section 7. Liability
Neither party will be liable for indirect, incidental, exemplary, special, or consequential damages; loss or corruption of data or interruption or loss of business; or loss of revenues, profits, goodwill, or anticipated sales or savings. The maximum aggregate liability of each party under this Agreement is limited to $5,000 USD. These limitations of liability do NOT apply to liability arising from (a) Your breach of Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services) or 9.7 (Export). These limitations of liability apply whether the claims are in warranty, contract, tort (including negligence), infringement, or otherwise, even if either party has been advised of the possibility of such damages. Nothing in this Agreement limits or excludes any liability that cannot be limited or excluded under applicable law. These limitations of liability are cumulative and not per incident.
Section 8. Termination and Suspension
8.1 Suspension. Cisco may immediately suspend Your Usage Rights if You breach Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services) or 9.7 (Export).
8.2 Termination. Cisco, in its sole discretion and for any or no reason, may terminate Your access to this Cisco Technology or any part thereof and any termination may be without prior notice and without liability to Cisco. Cisco may, for example, suspend or terminate Your access immediately if You breach Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services), or 9.7 (Export). Upon termination of this Agreement, You must stop using the Cisco Technology and destroy any copies of Software and Confidential Information within Your control.
Section 9. General Provisions
9.1 Survival. Sections 4 (Confidential Information and Use of Data), 5 (Ownership), 7 (Liability), 8 (Termination and Suspension), and 9 (General Provisions) survive termination or expiration of this Agreement.
9.2 Third-Party Beneficiaries. This Agreement does not grant any right or cause of action to any third party.
9.3 Assignment and Subcontracting. Except as set out below, neither party may assign or novate this Agreement in whole or in part without the other party’s express written consent. Cisco may (a) by written notice to You, assign or novate this Agreement in whole or in part to an Affiliate of Cisco, or otherwise as part of a sale or transfer of any part of its business; or (b) subcontract any performance associated with the Cisco Technology to third parties, provided that such subcontract does not relieve Cisco of any of its obligations under this Agreement.
9.4 U.S. Government End Users. The Software, Cloud Services and Documentation are deemed to be “commercial computer software” and “commercial computer software documentation” pursuant to FAR 12.212 and DFARS 227.7202. All U.S. Government end users acquire the Cisco Technology and Documentation with only those rights set forth in this Agreement. Any provisions that are inconsistent with federal procurement regulations are not enforceable against the U.S. Government
9.5 Modifications to this Agreement. Cisco may change this Agreement or any of its components by updating it on Cisco.com and/or the Documentation page, which can be found at https://community.cisco.com/. Cisco will exercise commercially reasonable efforts to provide notice of any material changes to this Agreement, and within three (3) business days of posting changes to this Agreement, they will be binding. If you do not agree with the changes, you must discontinue using the Cisco Technology at that time. If you continue using the Cisco Technology after that time, you will be deemed to have accepted the changes to this Agreement.
9.6 Compliance with Laws. Each party will comply with all laws and regulations applicable to their respective obligations under this Agreement. Cisco may restrict the availability of the Cisco Technology in any particular location or modify or discontinue features to comply with applicable laws and regulations.
If You use the Cisco Technology in a location with local laws requiring a designated entity to be responsible for collection of data about individual end users and transfer of data outside of that jurisdiction (e.g., Russia and China), You acknowledge that You are the entity responsible for complying with such laws.
9.7 Export. Cisco’s Software, Cloud Services, products, technology, and services (collectively the “Cisco Products”) are subject to U.S. and local export control and sanctions laws. You acknowledge and agree to the applicability of and Your compliance with those laws, and You will not receive, use, transfer, export, or re-export any Cisco Products in a way that would cause Cisco to violate those laws. You also agree to obtain any required licenses or authorizations
9.8 Governing Law and Venue. This Agreement, and any disputes arising from it, will be governed exclusively by the applicable governing law below, based on Your primary place of business (or primary residence, if you are not a business) and without regard to conflicts of laws rules or the United Nations Convention on the International Sale of Goods. The courts located in the applicable venue below will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the Agreement or its formation, interpretation or enforcement. Each party hereby consents and submits to the exclusive jurisdiction of such courts. Regardless of the below governing law, either party may seek interim injunctive relief in any court of appropriate jurisdiction with respect to any alleged breach of Cisco’s intellectual property or proprietary rights
Your Primary Place of Business Governing Law Jurisdiction and Venue
Any location not specified below
| State of California, United States of America | Superior Court of California, County of Santa Clara and Federal Courts of the Northern District of California
| Australia | Laws of the State of New South Wales, Australia | State and Federal Courts of New South Wales |
| Canada | Province of Ontario, Canada | Courts of the Province of Ontario |
| China | Laws of the People’s Republic of China | Hong Kong International Arbitration Center |
| Europe (excluding Italy), Middle East, Africa, Asia (excluding Japan and China), Oceania (excluding Australia) | Laws of England | English Courts |
| Italy | Laws of Italy | Court of Milan |
| Japan | Laws of Japan | Tokyo District Court of Japan |
| United States, Latin America or the Caribbean | State of California, United States of America | Superior Court of California, County of Santa Clara and Federal Courts of the Northern District of California |
If You are a United States public sector agency or government institution located in the United States, the laws of the primary jurisdiction in which You are located will govern this Agreement and any disputes arising from it. For U.S. Federal Government users, this Agreement will be controlled and construed under the laws of the United States of America.
9.9 Notice. Any notice delivered by Cisco to You under this Agreement will be delivered on Cisco.com. Notices to Cisco should be sent to Cisco Systems, Inc., Office of General Counsel, 170 West Tasman Drive, San Jose, CA 95134.
9.10 Force Majeure. Neither party will be responsible for failure to perform its obligations due to an event or circumstances beyond its reasonable control.
9.11 No Waiver. Failure by either party to enforce any right under this Agreement will not waive that right.
9.12 Severability. If any portion of this Agreement is not enforceable, it will not affect any other terms.
9.13 Entire agreement. This Agreement is the complete agreement between the parties with respect to the subject matter of this Agreement and supersedes all prior or contemporaneous communications, understandings or agreements (whether written or oral).
9.14 Translations. Cisco may provide local language translations of this Agreement in some locations. You agree that those translations are provided for informational purposes only and if there is any inconsistency, the English version of this Agreement will prevail.
9.15 Order of Precedence. If there is any conflict between this Agreement and any Cisco policies expressly referenced in this Agreement, the order of precedence is: (a) this Agreement; then (b) any applicable Cisco policy expressly referenced in this Agreement.
9.16 Language Election for Purchasers in Quebec. You confirm Your Agreement that this Cisco Technology is currently provided in English only.
Section 10. Additional Terms
10.1 Restrictions on Use by Minor Children. This Cisco Technology is not intended for use by persons younger than the age of consent in their relevant jurisdiction (e.g.,13 years old in the United States under the US Children’s Online Privacy Protection Act of 1998, or 16 or 13 years old in the European Union as per Member State law) (“Minor Children”). Minor Children are not permitted to create an account and You will not authorize Minor Children to access the Cisco Technology.
10.2 Capacity Restrictions. Your right to access and use this Cisco Technology is currently limited to five (5) nodes dedicated to applications/microservices.
10.3 Limited Community Support. This Cisco Technology is provided on a free-of-charge basis, as-is, and without support. Cisco has no obligation to maintain, repair, or upgrade this Cloud Service and Cisco will not provide user support services in connection with this Cisco Technology. User can refer to self-service help materials that cover a range of topics or reach out to our community forum to engage in community support discussions on our Documentation page at https://community.cisco.com/. Cisco makes no representations about and has no liability for these community support resources. All use of these resources, and the advice and guidance therein, is at Your own risk.
10.4 No Competitive Analysis. By agreeing to these terms, You represent and warrant that you will not use this Cisco Technology or its Documentation to (a) copy ideas, features, functions, or graphics; (b) develop competing products or services; or (c) perform competitive analyses.
10.5 Beta Functionality. User acknowledges and agrees that all or some components or functionality of the Cisco Technology may be in beta stage and may not have been (and may not become) productized or commercialized. You acknowledge that Your use and evaluation of this Cisco Technology is at Your own risk.
Section 11. Definitions
“Affiliate” means any corporation or company that directly or indirectly controls, or is controlled by, or is under common control with the relevant party, where “control” means to: (a) own more than 50% of the relevant party; or (b) be able to direct the affairs of the relevant party through any lawful means (e.g., a contract that allows control).
“Authorized Third Parties” means Your Users, Your Affiliates, Your third-party service providers, and each of their respective Users, permitted to access and use the Cisco Technology on Your behalf as part of Your Entitlement.
“Cisco” “we” “our” or “us” means Cisco Systems, Inc. or its applicable Affiliate(s).
“Cisco Content” means any (a) content or data provided by Cisco to You as part of Your use of the Cisco Technology and (b) content or data that the Cisco Technology generates or derives in connection with Your use. Cisco Content includes geographic and domain information, rules, signatures, threat intelligence, and data feeds, and Cisco’s compilation of suspicious URLs.
“Cloud Service” means the Cisco hosted software-as-a-service offering or other Cisco cloud-enabled feature described in this Agreement. Cloud Services include applicable Documentation and may also include Software.
“Confidential Information” means non-public proprietary information of the disclosing party (“Discloser”) obtained by the receiving party (“Recipient”) in connection with this Agreement, which is (a) conspicuously marked as confidential or, if verbally disclosed, is summarized in writing to the Recipient within a reasonable time period after disclosure and marked as confidential; or (b) is information which by its nature should reasonably be considered confidential whether disclosed in writing or verbally.
“Delivery Date” means the date on which the Cloud Service is made available for Your use or, when Usage Rights in Software and Cloud Services are granted together, the earlier of the date Software is made available for download, or the date on which the Cloud Service is made available for Your use.
“Documentation” means the technical specifications and usage materials officially published by Cisco or available on https://community.cisco.com/ specifying the functionalities and capabilities of the applicable Cisco Technology.
“Entitlement” means the specific metrics, duration, and quantity of Cisco Technology that You acquire from Cisco under this Agreement.
“Software” means the Cisco computer programs including Upgrades, firmware and applicable Documentation.
“Upgrades” means all updates, upgrades, bug fixes, error corrections, enhancements and other modifications to the Software.
“Usage Term” means the period commencing on the Delivery Date and continuing until expiration or termination of the Entitlement, during which period You have the right to use the applicable Cisco Technology.
“User” means the individuals (including contractors or employees) permitted to access and use the Cisco Technology on Your behalf as part of Your Entitlement.
“You” means the individual or legal entity using the Cisco Technology.
NEW Cloud Security Academy Level up your skills with hands-on lessons. Get started
Kubernetes and Container Security Tools You Must be Aware Of
Panoptica Team
Monday, Apr 19th, 2021
Threat detection, container lifecycle management, container registries, and access control tools. Whether paid or free, the web is full of container security tools allowing developers and organizations to maintain a secure environment.
This blog post will focus on Kubernetes and container open source security tools, as we believe some free tools deliver no less than their commercial equivalents. Start with these free, readily available cloud infrastructure tools and then when you’re ready to consider an ongoing solution for high severity vulnerabilities - give us a call!
What is a container security tool?
Securing containers is a really important part of running and managing a cloud environment. Your container workloads will be part of a broader ecosystem within your business, including public cloud like Google cloud platform, Amazon web services or Azure, any private cloud instances like VMware, as well as hybrid cloud or serverless computing. You will probably be using infrastructure-as-a-service and platform-as-a-service functions that include RDS or S3 buckets. You’re likely running container orchestration like Docker or Amazon ECS. As containers are dynamic, they can be tough to secure as part of this ever-changing reality. Some containers might only be connected for a matter of seconds, while others are more long-term.
Another challenge is that DevOps are usually responsible for creating and maintaining containers. They use continuous integration and continuous delivery, often called CI/CD pipelines to keep the fast pace of business that you’re used to and to keep up with the competition and customer demand. But if security isn’t part of this process, you could quickly leave yourself open to risk. DevOps aren’t security trained, so the right container tools and security technologies are essential.
Container security tools do more than just vulnerability detection. They ensure that everything in your container is running as you programmed it to. The process of securing containers must run continuously while securing the container host, its network traffic, and its management stack but also while monitoring the integrity of the build pipeline, your application security, and its foundational layers within the container.
Here are some of our favorite open-source container tools that do exactly that.
Clair
When considering static analysis tools, Clair is one of the best out there. Clair is a comprehensive auditing tool based on multiple CVE databases, performing static analysis of any vulnerabilities within your OCI and Docker containers.
The process of identifying security vulnerabilities is based on indexing a list of features within a particular container image and then querying the database for vulnerabilities connected to that image.
The database includes a lot of sources, more than many similar tools of its kind, including data from Red Hat Security, Debian, Ubuntu, and more. Not only that, but your developers can add their own drivers to scan for additional behaviors within Docker images and the like, putting your developers in control. Rather than manually checking through report logs, the API calls for specific container images streamlines the process from end to end.
Anchore
In a similar way to Clair, above - Anchore is another container security tool based on CVE data and that uses container images. Anchore enables Docker container image inspection and analysis with the use of custom policies.
There is a lot of flexibility in the Anchore platform, as you can create whitelists and blacklists for certain policies, basing this on specifics such as the configuration, the credentials used, and even the file contents itself.
The tool can run as stand-alone or on platforms such as Kubernetes, including Jenkins and GitLab integration for CI/CD.
Scanning container images will provide developers or security staff with a list of vulnerabilities and risk levels, and there is a simple Command-line interface (CLI) that can be used to get the information you need.
Grafeas
If you’re looking for an open-source tool to define and source container metadata for virtual machines and containers, Grafeas is a great choice. Grafeas is a component metadata API based container security tool created by IBM & Google that allows for the creation of container security scanning projects.
Grafaes can enforce security policies on Kubernetes clusters that use Grafaes metadata. We like this tool because it helps get mitigation up and running quicker and with less manual work, which means as soon as an exploit has been uncovered, you’re a lot closer to remediation. On top of that, as Grafeas has the might of IBM and Google behind it, you’re getting more confidence than your average open-source tool.
Cilium
Having visibility at the kernel is a really powerful security tool to have at your fingertips, and Cilium provides API-aware networking security at this level, so it’s a definite must-have for our list of top container tools.
This open source tool is run by Berkeley Packet Filter, now known as BPF, which is a Linux kernel technology. Without any need to change your underlying application code or the configuration of your containers, Cilium allows you to create security policies and update them. This is a lightweight benefit that pays dividends.
There is also a strong community around Cilium, which means you can get a lot of support and advice where necessary. There’s even a Slack channel and a weekly meeting for developers, so it’s a great choice for those who need a bit more hand holding when it comes to open source or security of this environment.
Dagda
Here’s another static analysis tool for finding known vulnerabilities. Dagda can be used to analyze your container environment, and find problems such as malware, viruses or trojans inside containers and Docker images. This is done using the ClamAV antivirus engine.
There are a few steps to the Dagda process. First, CVEs are used from well known databases such as Red Hat Security Advisories and Bug Advisories, and BID. Then the images and containers will be analyzed against these CVEs.
You then run a static analysis of these vulnerabilities, and the Dagda tool will take information such as the OS packages and any dependencies, and then these will be verified against the information that has been pulled in and is being stored in the MongoDB, plus any malicious activity will be found using the AV engine.
Unique elements of Dagda are that you have support for multiple Linux images such as Alpine, Ubuntu, and OpenSUSE, and you can analyze dependencies from many programming languages - including java, python node js, PHP, ruby etc. Keep reading to learn about Falco below - because you can integrate Dagda with Falco too, to monitor running containers.
Sysdig Falco
Created by Sysdig, Falco is a Kubernetes security auditing tool by Sysdig that monitors containers, hosts, and network activities. It is used for continuous infrastructure checks and to detect anomalous activity.
Behavioral activity monitoring has become more common in recent years, especially for complex environments like containers, where visibility is essential. Falco works behind the scenes to continuously check infrastructure for any kind of Linux system. You can use Falco to find out more about your container environment, for example suspicious behavior or calls, outbound network attempts, or access to sensitive data.
OpenSCAP Workbench
OpenSCAP isn’t one container security tool, it’s actually a cluster of multiple tools that affords organizations efficient development of security content. You can use OpenSCAP to create policies and then maintain them on platforms that include CentOS, Red Hat Enterprise Linux, Fedora, or Scientific Linux, simply by using a GUI. Automatically, scans will be run on your containers, VMs and Docker images.
Not sure what SCAP is? It stands for Security Content Automation Protocol, and it’s certified by NIST. The security policies are machine-readable, and OpenSCAP is proud of its ability to reduce the costs of performing security audits.
JFrog Xray
One scanning tool which has received a lot of attention lately is JFrog Xray. This is an artifact analysis tool, and will provide a continuous picture of all artifacts as well as dependencies. Interestingly this can be used for wider security vulnerabilities as well as issues such as license compliance and other errors.
With a native integration with JFrog Artifactory, you can get visibility into the metadata, and all the necessary security information in one view. JFrog uses a continuously growing database of vulnerabilities to alert users of any issues, and will support all package types, including those in zip files, or those that are packaged in Docker images. Touching on graph-based analysis, you will receive a graph of your artifacts and the structure of any dependencies, providing a visual understanding of the gaps or issues in your environment.
Kube-hunter
Looking for an open-source Kubernetes scanner? Kube-hunter is an open source tool for pen-testing both your cluster and its nodes, or as described on its own github page - the kube-hunter "hunts for security weaknesses in Kubernetes clusters".
Kube-hunter allows you to attack your own kubernetes environment in order to identify blind spots and gaps before an attacker finds them for you. The way it works is that the kube-hunter will test for container configuration issues by probing any domain or address range for open ports. You can run kube-hunter as a container on any machine, or as a pod within the cluster, and you’ll get the same view the attackers have of your environment - with clear reporting and understanding over how exposed this cluster or container would be.
One of the things we like the most about kube-hunter is the sheer breadth of tests that the open source tool offers. These tests are categorized into active and passive tests. Passive tests include API Service Discovery, Dashboard Discovery, Etcd Service, Host Discovery, Kubectl Client Discovery, Kubelet Discovery, and Port Scanning and Proxy Hunting and Discovery, plus Access Secrets.
Active tests include a foothold test which is done via a secure Kubelet Port, malicious intent test to see if an attacker could leverage privileged containers, and hunters for issues found in container logs, system logs, Azure subscription files, API servers, and potential spoof attacks like DNS or ARP.
Kube-bench
The kube-bench security tool is another open-source vulnerability scanner that checks the Kubernetes cluster's deployment, making sure it was done while following security best practices as the Center for Internet Security defines them (click here for CIS Kubernetes Benchmark). There are a number of ways to run kube-bench.
One can run the kube-bench within a pod, however be aware that you’ll need to provide access to the host’s PID namespace, which will allow the tool to check the running processes and get access to the right files.
The result of this series of tests will be the highlighting of areas of the Kubernetes environment that do not comply with CIS benchmarks as well as some optional solutions to resolve them. Here’s some support with how to run kube-bench against an EKS cluster in AWS.
Kubeaudit
Another recommendation is Kubeaudit by Shopify, run by aqua security. This open-source tool audits Kubernetes clusters while comparing them to security tests known as "auditors". The tests check all kinds of parameters, including the pods' security context and any misconfigurations inside the clusters.
As in kube-bench mentioned above, this kubernetes security tool not only identifies vulnerabilities in Kubernetes clusters but also offers recommended solutions to solve each and every one of them, which can help developers who need to keep up the pace of an agile development environment.
Understanding the Limit of Open-Source Security Tools for Container and K8S Security
These are a roundup of some of our favorite tools that can help with container runtime security, network security, and other security threats. However, there is always going to be a limit to the effectiveness of security procedures that are based on CVEs and known signatures. Getting into the mind of the attacker means taking two steps back and being able to get a full view of your environment and its open attack paths, in the context of what matters in your business environment. Hey, that’s exactly what we do at Panoptica!
Get in touch if you want to discuss your own contextual cloud security environment, and how to shore up any gaps before the attackers find them for you.
Have we missed any of your favorite open source container security tools which you think should be on this list?
SIGN UP FREE
