Contactez-nous Suivez-nous sur Twitter En francais English Language

De la Théorie à la pratique

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN



Aqua Security Announces the Industry’s Advanced Kubernetes Security Solution

October 2020 by Marc Jacob

Aqua Security announced a suite of new Kubernetes-native security capabilities, providing a holistic approach to securing applications that run on Kubernetes, across the development, deployment, and runtime phases of the application lifecycle. The company also announced significant new features in its Cloud Security Posture Management (CSPM) solution. These new capabilities, which will be generally available next week, are integrated into Aqua’s cloud native security platform, covering the spectrum of deployment options across containers, VMs and serverless functions.

In a recent research note, Gartner asserts that “Kubernetes’ inherent complexity often leads to outdated versions and misconfiguration by organisations, making clusters susceptible to compromise. Though some security mechanisms are included by design, K8s by itself is not a security offering, and security settings aren’t always enabled by default. Protecting a K8s cluster is a significant undertaking, requiring both substantial understanding of the underlying technology and engineering expertise to configure it all.” *

Aqua’s new Kubernetes security solution addresses the complexity and short supply of engineering expertise required to configure Kubernetes infrastructure effectively and automatically, by introducing KSPM - Kubernetes Security Posture Management – a coherent set of policies and controls to automate secure configuration and compliance. Additionally, Aqua now offers new agentless runtime protection capabilities, that use Kubernetes itself to deploy security controls into pods, leveraging and extending the native capabilities built into Kubernetes.

Aqua KSPM includes several new and innovative capabilities:

· Kubernetes Assurance Policies: With more than 20 predefined rules available out of the box, and the ability to use OPA (Open Policy Agent) Rego rules, these policies define which Pods may be deployed in a cluster based on multiple parameters. These policies work in conjunction with Aqua’s Image Assurance Policies to control which containers run in your cluster based on both their image contents and configuration, as well as Pod configuration.

· Kubernetes Roles and Subjects Assessment: Reduces administration overhead of maintaining Kubernetes user and service account privileges by identifying risks and suggesting their remediation. This addresses least privilege security gaps while diminishing the need for Kubernetes security expertise, which is in short supply.

These new capabilities join Aqua’s existing certified CIS benchmark testing (powered by Aqua’s open source Kube-Bench), and penetration testing (powered by Aqua’s open source Kube-Hunter), providing enterprises with comprehensive insight into the security posture of their Kubernetes cluster, and the ability to address gaps efficiently with no need for specialised expertise.

With its new Kubernetes Runtime Protection module, Aqua introduces a new model for deploying security runtime controls in a Kubernetes cluster, complementing its existing container runtime security deployment options. This new model leverages Kubernetes Admission Controllers to deploy and govern sidecar containers within Pods, in a similar fashion to other cloud native tools such as Envoy. This mode of deployment enables greater automation of deployment and does not require any privileges on the node’s host OS, while providing dynamic runtime controls such as container drift prevention, behavioural controls, and network controls.

In addition to the extensions to Kubernetes security capabilities, this latest release adds many new features and enhancements including:

· New customisable dashboard: Provides a clear view of the overall security status of your cloud native environment with dedicated widgets for key areas, such as host and image/container security, and drag & drop design. The new dashboard supports Aqua’s RBAC model to filter viewable data according to user role permissions.

· AWS Bottlerocket support: The new AWS operating system for running containers is now available as a protected workload platform.

· Auto-remediation for Azure in Aqua CSPM: Aqua CSPM now provides remediation advice and auto-remediation options for Azure cloud services, previously available for AWS.

· New compliance reports in Aqua CSPM: Aqua CSPM now provides out-of-the-box compliance reports for additional compliance reporting, including SOC 2 Type 2, ISO27001, NIST SP 800-53, and NIST CSF.

· VM security: Now allows flexible scan scheduling, scan history review, and malware scans on mounted NFS shares.

* Gartner, Guide to Application Security Concepts, Michael Isbitski and Frank Catucci, 29 July 2020

See previous articles


See next articles