RunTime Threat Mapping for AWS EKS using Deepfence ThreatMapper

Introduction

If we want to unify the development and DevOps perspectives of the application and the environment with the SecOps view, we need to have tools that can observe what's happening, identify threats, and provide security.

Deepfence ThreatMapper:

Deepfence ThreatMapper is an open-source security observability platform that helps teams identify active threats and vulnerability exposure in production, especially in cloud-native environments.

How can Deepfence ThreatMapper help us?

The applications are built on various open-source technology stacks, pulling in third-party modules. With developers constantly pushing the code and images into repositories, and the operations team integrating various agents on the production workload for several purposes like logging, how can we ensure that our applications are protected against vulnerabilities, malware, and exposed secrets?

Deepfence ThreatMapper helps identify these risks and vulnerabilities.

Objective:

Monitor the AWS EKS cluster to uncover vulnerabilities in the software components, malware, and exposed secrets within the environment using ThreatMapper.

Installation:

The core components of ThreatMapper are the management console and sensor agents. ThreatMapper can be deployed as a containerized application on a single Docker host or across a distributed Kubernetes cluster. In this guide, we install ThreatMapper on an Amazon EC2 Ubuntu instance.

System Requirements:

Resources: 4 vCPU, 16GB RAM.

Port configurations: HTTPS (443)

Instance type: t2.xlarge

Docker: Minimum version 18.06.0

Tune the system limits on mmap counts:

sudo systemctl -w vm.max_map_count=262144

Deploy Management console:

Steps:

sudo apt install -y apt-transport-https ca-certificates curl software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg |


sudo apt-key add sudo add-apt-repository "deb [arch=amd64]


https://download.docker.com/linux/ubuntu focal stable"


apt-cache policy docker-ce


sudo apt install -y docker-ce

sudo curl -L


 https://github.com/docker/compose/releases/latest/download/


 docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose

sudo wget https://github.com/deepfence/ThreatMapper/raw/master/deployment-scripts/docker-compose.yml

sudo docker-compose up --detach

docker ps

The console may take one to two minutes to load.

Deploy sensor agents in the Kubernetes environment:

helm repo add deepfence


helm repo add deepfence https://deepfence-helm-charts.s3.amazonaws.com/threatmapper


helm show readme deepfence/deepfence-agent


helm show values deepfence/deepfence-agent


 


helm install deepfence-agent deepfence/deepfence-agent \


  --set managementConsoleUrl=X.X.X.X \


  --set deepfenceKey=APIKEY \


  --set image.tag=1.5.0 \


  --set image.clusterAgentImageTag=1.5.0 \


  --set clusterName=CLUSTERNAME \


  --set mountContainerRuntimeSocket.containerdSock=true \


  --set mountContainerRuntimeSocket.dockerSock=false \


  --set mountContainerRuntimeSocket.crioSock=false \


  --set mountContainerRuntimeSocket.containerdSockPath="/run/containerd/containerd.sock" \


  --namespace deepfence \


  --create-namespace

kubectl get pods -n deepfence

After deploying the sensor agents, we can view the details of the K8s environment on the management console. Deepfence provides a feature called "topology-based view" that allows us to visualize the live infrastructure either graphically or through a tabular interface if it is a complex one. We have our workloads in the AWS Cloud, which runs in the ap-south-1 (Mumbai) region. The installed agents are collecting the network traffic coming from the internet to the hosts and the containers.

Now we can run a vulnerability scan, a secret scan, or a malware scan by selecting any of the Kubernetes hosts or specific containers. Also, we can run a one-time scan of our whole Kubernetes cluster. They will scan both the container images for vulnerabilities within a pod and also the host operating system. These scans sit and run in the background, gathering SBOM (software bill of materials) information and reporting back. Finally, we got the scan results for our individual host.

Most importantly, ThreatMapper has the ability to stack-rank vulnerabilities so that we know what to fix first.

With the ThreatMapper Cloud scanner, we can run a compliance scan on our cloud service account and evaluate results against benchmark controls.

We can also use ThreatMapper to perform the same scans against workloads that are hosted in registries.

Please feel free to reach out to me at manigandhan@refactorq.com in case you need any help or have any doubts about integrating ThreatMapper in your cloud setup.

Reference links: