New Kubernetes security posture management (KSPM) and agentless runtime protection empower organisations to defend K8s-based applications against multiple threats
Aqua Security announced a suite of new Kubernetes-native security capabilities, providing a holistic approach to securing applications that run on Kubernetes across the development, deployment, and runtime phases of the application lifecycle. The company also announced significant new features in its Cloud Security Posture Management (CSPM) solution. These new capabilities are integrated into Aqua’s cloud native security platform, covering the spectrum of deployment options across containers, VMs, and serverless functions.
In a recent research note, Michael Isbitski and Frank Catucci from Gartner asserts that “Kubernetes’ inherent complexity often leads to outdated versions and misconfiguration by organisations, making clusters susceptible to compromise. Though some security mechanisms are included by design, K8s by itself is not a security offering, and security settings aren’t always enabled by default. Protecting a K8s cluster is a significant undertaking, requiring both substantial understanding of the underlying technology and engineering expertise to configure it all.”
Kubernetes Security Posture Management (KSPM)
KSPM automates set of policies and controls to secure configuration and complianceAqua’s new Kubernetes security solution addresses the complexity and short supply of engineering expertise required to configure Kubernetes infrastructure effectively and automatically by introducing KSPM - Kubernetes Security Posture Management, a coherent set of policies and controls to automate secure configuration and compliance. Additionally, Aqua now offers new agentless runtime protection capabilities that use Kubernetes itself to deploy security controls into pods, leveraging and extending the native capabilities built into Kubernetes.
“The large-scale use of Kubernetes, as well as developments in the threat landscape, necessitate a comprehensive approach to securing applications that goes beyond generic benchmarks, providing seamless workload protection in runtime,” noted Amir Jerbi, CTO and co-founder at Aqua. “We’ve been working with our enterprise customers to make it easier to securely deploy and seamlessly protect applications that run on Kubernetes, while complementing our existing capabilities in Kubernetes and container security.”
KSPM new and innovative capabilities
- Kubernetes Assurance Policies: With more than 20 predefined rules available out of the box, and the ability to use OPA (Open Policy Agent) Rego rules, these policies define which Pods may be deployed in a cluster based on multiple parameters. These policies work in conjunction with Aqua’s Image Assurance Policies to control which containers run in one's cluster based on both their image contents and configuration, as well as Pod configuration.
- Kubernetes Roles and Subjects Assessment: Reduces administration overhead of maintaining Kubernetes user and service account privileges by identifying risks and suggesting their remediation. This addresses the least privilege security gaps while diminishing the need for Kubernetes security expertise, which is in short supply.
These new capabilities join Aqua’s existing certified CIS benchmark testing (powered by Aqua’s open source Kube-Bench), and penetration testing (powered by Aqua’s open source Kube-Hunter), providing enterprises with comprehensive insight into the security posture of their Kubernetes cluster, and the ability to address gaps efficiently with no need for specialised expertise.
Enhanced security extensions
With its new Kubernetes Runtime Protection module, Aqua introduces a new model for deploying security runtime controls in a Kubernetes cluster, complementing its existing container runtime security deployment options. This new model leverages Kubernetes Admission Controllers to deploy and govern sidecar containers within Pods, in a similar fashion to other cloud native tools such as Envoy. This mode of deployment enables greater automation of deployment and does not require any privileges on the node’s host OS while providing dynamic runtime controls such as container drift prevention, behavioural controls, and network controls.
In addition to the extensions to Kubernetes security capabilities, the latest release adds many new features and enhancements including:
- New Customisable Dashboard: Provides a clear view of the overall security status of your cloud native environment with dedicated widgets for key areas, such as host and image/container security, and drag & drop design. The new dashboard supports Aqua’s RBAC model to filter viewable data according to user role permissions.
- AWS Bottlerocket Support: The new AWS operating system for running containers is now available as a protected workload platform.
- Auto-Remediation for Azure in Aqua CSPM: Aqua CSPM now provides remediation advice and auto-remediation options for Azure cloud services, previously available for AWS.
- New Compliance Reports in Aqua CSPM: Aqua CSPM now provides out-of-the-box compliance reports for additional compliance reporting, including SOC 2 Type 2, ISO27001, NIST SP 800-53, and NIST CSF.
- VM Security: Now allows flexible scan scheduling, scan history review, and malware scans on mounted NFS shares.
