Practical Cloud Native Security with Falco

Chapter 11. Using Falco for Cloud Security

Now that you’ve learned all you need to know about configuring and running Falco, it’s time to focus on an important topic that can have a huge impact on your security posture: cloud security.

If you are reading this book, there is a good chance that some of your software (or all of it!) runs in the cloud. Since AWS is the leading provider of cloud services, there is also a good chance that your software is running there.

Public clouds are great environments to run software. Their support for elasticity, flexibility, and automation makes building and running apps easier and more efficient. However, cloud-based apps and the data they use are exposed to attacks from the whole planet. They are also exposed to misconfigurations, mistakes, and malicious behavior from internal teams.

A comprehensive security posture needs to take many domains into account, including applications, users (external and internal), and data. Failing to properly protect any one of these domains will result in gaps and therefore in risk. For example, protecting workloads that run in containers and hosts (which you can do effectively with Falco) is not beneficial unless you also cover the cloud infrastructure where these workloads run.

Fortunately, Falco can bridge this gap and help you achieve the coverage you need. Let’s learn how!

Why Falco for AWS Security?

Cloud security is a fertile and constantly evolving space with many implementation options. Architecturally, ...