Practical Cloud Native Security with Falco

Preface

The advent of modern computing stacks is radically changing how we think about security. In the old data center days, security practitioners thought of software applications as medieval castles: securing them involved building big walls with small, well-guarded openings. Modern cloud-based software looks more like a bustling modern city: people move freely inside it and across its limits to consume and provide services and buy, sell, build, and fix things.

As today’s urban planners know, big walls and guarded entrances alone are not enough to secure a city. A better approach involves widespread, granular visibility: a network of security cameras, for example, plus the ability to view their footage and react to any threats they capture in real time.

This book is about security for modern applications, using the open source tool that the industry has embraced as the “security camera” for the cloud native stack: Falco. Falco is a cloud native runtime security project designed to protect software that runs in the cloud by detecting unexpected behavior, intrusions, and data theft in real time. It’s the de facto threat detection engine for Kubernetes and for cloud infrastructure, deployed by countless users, from single-machine test environments to some of the biggest computing environments on the planet. We’ll teach you how you can protect applications as they run by detecting threats and misconfigurations in workloads and in the cloud infrastructure where they operate.

We ...