PromQL for security Carlos Arilla carlos@sysdig.com - PowerPoint PPT Presentation

Mar 16, 2023 •118 likes •270 views

PromQL for security Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_ November 2019 Hello World Carlos Arilla Tech Marketing Engineer @ Sysdig Father of 3! Professional interests: Personal interests: Cloud Native

PromQL for security Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_ November 2019
Hello World Carlos Arilla Tech Marketing Engineer @ Sysdig Father of 3! Professional interests: Personal interests: • Cloud Native • SciFi • Microservices • Video-games • Monitoring • Sports • DevOps • IoT and robots
My beloved children
Let’s talk about monitoring
Let’s talk about monitoring security
Monitoring and security Are monitoring and security completely separated topics? • Many times one of the first indicators of a security issue is a change in resource usage. Cryptojacking? • Security usually is related to knowledge. Monitoring can provide insight and knowledge in real time. • DevOps teams have been the paladins of monitoring. Now they are assuming security functions too. The ability of combining tools for both can be differential.
PromQL example 1: load increase 100 - (avg by (instance) (irate(node_cpu_seconds_total{job="node",mode="idle"}[5m])) * 100) Goals • Many intrusions are a way to use your compute resources for different interests: cryptomining, spam, DDoS… • A sudden increase of resources can be an indicator of a security breach being exploited. Next level: Pods running in Kubernetes without limits: (sum(kube_pod_status_ready{condition="true"}) by (pod) == 1) unless sum(kube_pod_container_resource_limits_cpu_cores) by (pod)
PromQL example 2: Vulnerable versions sum(go_info) by (app,version) Goals: • This allows to detect vulnerable versions of different libraries or implementations • Instrumenting library versions can be an easy way to detect vulnerabilities in your system.
PromQL example 3: Certificate expiration change change(rate(sum(ssl_certificate_expiry_seconds{}) by (instance, path))) Goals: • Certificate expiration information is widely instrumented. • Unexpected changes in expiration could indicate supplantation attacks. Next level: Check TLS/SSL version with blackbox exporter: probe_tls_version_info{}
PromQL example 4: Cost increase control AWS Cost Exporter can provide information of daily costs: https://github.com/nachomillangarcia/prometheus_aws_cost_exporter Kubernetes HPA can spawn new nodes, watch your clusters! sum(up{job="node-exporter"}) Goals: • A typical target for attacker is to spawn new machines to run crypto mining, spam or DDoS. • ASG, HPA or other automated scaling methods should be watched.
PromQL example 5: 401 errors sum(rate(apiserver_request_total{code=”401|403"}[5m])) Goal: • A good number of 401 (Unauthorized) can be a good indicator of illegitimate access tries. • This can be extended to 403 (Forbidden).
Some more ideas... • Network connections: https://github.com/hiveco/conntrack_exporter •
What I learnt Secure Devops is a necessity! • Security has to be moved “left” in the development cycle. • Instrumentation should have security information built-in by design. • DevOps teams have real responsibility in security.
Thank you very much!! Questions? Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_

Recommend

PromQL for Mere Mortals Ian Billett Software Engineer ianbillett@improbable.io /billett_ Date

PromQL for Mere Mortals Ian Billett Software Engineer ianbillett@improbable.io /billett_ Date 07/11/19 Agenda Intro Gauges & Counters PromQL is important How en-gauge-ing Time Series Operators & Functions Series-ly cool

529 views • 30 slides

LogQL in 5 minutes Cyril Tovena What is LogQL ? What is LogQL ? Language to query logs from

LogQL in 5 minutes Cyril Tovena What is LogQL ? What is LogQL ? Language to query logs from Loki. Heavily inspired by PromQL. Distributed grep. | 4 Selecting time series with PromQL http_request_duration_seconds_count{

311 views • 13 slides

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM & UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides