apply-cloud-runtime-security

name	apply-cloud-runtime-security
description	Use when running workloads in cloud environments — enabling GuardDuty, Security Command Center, or Microsoft Defender, and deploying Falco for Kubernetes runtime threat detection.
source	OWASP Cloud-Native Application Security Top 10 C1 (owasp.org/www-project-cloud-native-application-security-top-10/); AWS GuardDuty documentation; Falco project documentation; CNCF Security Technical Advisory Group
tags	["security","owasp","cloud","runtime-security","guardduty","falco","threat-detection","developer"]

Apply Cloud Runtime Security

Enable cloud-native threat detection (GuardDuty, Security Command Center, Defender) and deploy Falco for container syscall monitoring — detecting credential theft, cryptomining, lateral movement, and container escapes that static IaC scanning cannot catch.

Why This Is Best Practice

Adopted by: OWASP Cloud-Native Application Security Top 10 C1 (Insecure Cloud, Container, and Orchestration Configuration). AWS GuardDuty is enabled by default in AWS Security Hub and required for AWS Foundational Security Best Practices compliance. CNCF Security Technical Advisory Group's "Cloud Native Security Whitepaper" (2022) mandates runtime threat detection for production workloads. Falco (CNCF project) is the standard open-source runtime security tool, used by Shopify, Kubernetes maintainers, and major cloud providers in their security posture. Impact: Netflix's chaos engineering team documented that 60% of their theoretical cloud attack paths are only detectable at runtime — not by IaC scanning or static analysis. AWS GuardDuty detected the 2022 Capital One breach indicators (SSRF to IMDS, unusual S3 API calls) within 4 hours of initial access — the breach would have been caught earlier with GuardDuty enabled from day one. Aqua Security's 2023 Cloud Native Threat Report found that 50% of cloud attacks involve cryptomining that starts within minutes of container compromise — detectable only by runtime monitoring of network connections and CPU patterns. Why best: IaC scanning (Checkov, tfsec) detects misconfigurations before deployment. Runtime security detects attacks happening right now — a container that was correctly configured at deploy time can be compromised via a zero-day, supply chain attack, or application vulnerability. Runtime security provides the detective layer that IaC scanning cannot replace.

Sources: OWASP Cloud-Native Top 10 C1; AWS GuardDuty documentation; CNCF Cloud Native Security Whitepaper (2022); Aqua Security Cloud Native Threat Report (2023)

Steps

1. Enable AWS GuardDuty with EKS and malware protection:

   # Enable GuardDuty in all regions (use AWS Organizations for multi-account)
   aws guardduty create-detector \
     --enable \
     --features '[
       {"Name": "EKS_AUDIT_LOGS", "Status": "ENABLED"},
       {"Name": "EKS_RUNTIME_MONITORING", "Status": "ENABLED",
        "AdditionalConfiguration": [
          {"Name": "EKS_ADDON_MANAGEMENT", "Status": "ENABLED"}
        ]},
       {"Name": "S3_DATA_EVENTS", "Status": "ENABLED"},
       {"Name": "MALWARE_PROTECTION", "Status": "ENABLED"}
     ]'
   

   # CloudWatch Events rule — route high-severity findings to SNS
   GuardDutyHighSeverityAlarm:
     Type: AWS::Events::Rule
     Properties:
       EventPattern:
         source: [aws.guardduty]
         detail-type: [GuardDuty Finding]
         detail:
           severity: [{numeric: [">=", 7]}]  # HIGH and CRITICAL
       Targets:
       - Arn: !Ref SecurityAlertTopic
         Id: SecurityTeamAlert
   

2. Deploy Falco for Kubernetes runtime syscall monitoring:

   # Install Falco via Helm
   helm repo add falcosecurity https://falcosecurity.github.io/charts
   helm install falco falcosecurity/falco \
     --namespace falco \
     --create-namespace \
     --set driver.kind=ebpf \
     --set falcosidekick.enabled=true \
     --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/..."
   

Rules

• Enable GuardDuty/Security Command Center/Defender in ALL regions, not just primary — attackers exploit enabled-but-unmonitored regions.
• Falco rules must be tuned to the environment — default rules generate high noise in production; tune to reduce false positives before alerting is useful.
• CloudTrail logs must be in a dedicated account or with SCP-enforced write protection — an attacker with admin access can delete CloudTrail logs to cover tracks.
• Runtime security findings must have defined response playbooks — an alert with no response procedure is theater.

Common Mistakes

• GuardDuty enabled but findings going to an unmonitored email — without on-call routing (PagerDuty/OpsGenie), high-severity findings are seen days later.
• Falco deployed without eBPF driver on modern kernels — the legacy kernel module driver requires kernel headers and doesn't work on all managed node groups; use eBPF.
• Not monitoring for iam:CreateAccessKey or sts:GetCalledUserIdentity — these are early indicators of credential theft; alert on IAM actions not in expected patterns.
• CloudTrail delivering to an S3 bucket in the same account — an attacker with admin access can delete both the trail and the bucket; use cross-account log delivery with SCP protection.