Automating the Security of Kubernetes Clusters in the Cloud
When startup Cast AI in November 2023 pulled in $35 million in Series B funding, co-founder and CEO Yuri Frayman said the company would use the money to expand the capabilities of its AI-based Kubernetes automation platform, which up to that point was primarily used to help organizations optimize the cost of running their K8s clusters in the cloud.
According to the vendor’s numbers, its Kubernetes Automation Platform enables enterprises to cut their Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform costs by as much as 50% with such capabilities as automated scaling and provisioning. The platform’s continuous cost tracking and monitoring and right-sizing of workloads also improves cluster performance and increases the productivity of DevOps and engineering teams.
These capabilities are important, given the reach of Kubernetes. According to the Cloud Native Computing Foundation (CNCF), more than 5.6 million developers use Kubernetes, which has a 92% share of the container orchestration tool space. Kubernetes is critical to the cloud efforts of many organizations and their developers.
Now five-year-old Cast AI is turning its focus to helping enterprises secure their K8s clusters, which Gil Laurent, co-founder and chief product officer, said is a key concern of developers.
“A lot of our users are the DevOps engineers and they told us, The thing that troubles us with cloud native is security,” Laurent told The New Stack. “It’s very hard to understand security in Kubernetes. Does it belong to the traditional chief security CISO suite [that oversees] the overall security posture of the firm or does this belong to those that actually have access to it and can fix it?”
Users were asking company executives whether they could make their Kubernetes clusters not only more efficient but also secure. Laurent noted that they already were using a trained AI engine to be efficient, using machine learning techniques to make the clusters run smoothly without overprovisioning resources, which has been a key problem with the cloud, according to Cast AI, which found that last year developers were overprovisioning the number of CPUs they need by 43%.
“But efficiency can also say it’s more secure and that is really where it comes from,” Laurent said. “It really came from that evolution of us becoming a platform.”
Now Comes the Automated Security
The “it” is Cast AI’s new automated Kubernetes Security Posture Management (KSPM) solution, unveiled this month as another capability on the Kubernetes Automation Platform. The new offering delivers a range of services, from real-time scanning of Kubernetes clusters to detect misconfigurations, image vulnerabilities, and compliance problems to detecting runtime anomalies and offering remediation steps, such as automated node operating system patching.
Cast AI Security Dashboard.
Cast AI’s platform already had some container security capabilities, but the KSPM greatly expands on those.
“We have that level of trust and credibility of our users,” Laurent said. “These users are all the same. They’re DevSecOps or the DevOps engineers. They know that they have a lot of patching that’s not applied. They cannot do anything. They have to ask the other guy, who is a developer, to rebuild the image and select the right patch available. We do this automatically.”
AI in Cybersecurity
The need is there. Cast AI pointed to a ShadowServer report that found that more than 380,000 open Kubernetes APIs — about 84% of all Kubernetes API instances in the world — on the internet that allow some kind of access.
Bob O’Donnell, chief analyst with TECHnalysis Research, told The New Stack that “one of the more promising opportunities for generative AI is going to be in automation because it is designed to identify and understand processes and operations.”
The emerging technology can look at what’s going on in a cluster and can detect when an operation is normal and when it isn’t, giving developers a heads-up on possible threats. In an upcoming study by TECHnalysis about how enterprises use generative AI, the seventh most popular use case is security, coming in behind others like collaboration, process automation, and code generation. While being seventh may now sound impressive, in the survey, it means that 64% of organizations are using it for security, O’Donnell said.
Two Buckets for Threats
Laurent said security threats tend to fall into large buckets. The first has to do with anomalies — essentially identifying when clusters in the cloud are not behaving as expected. The other addresses the use by developers of outdated versions of software or other components.
“This is a big issue because patching is not here to say there’s a new version,” he said. “It’s here because something bad has been identified that can be exploited, and usually it’s easy to scavenge. It’s the simplest thing to fix, and yet it’s the most well-known and best place to go and hack a company.”
Cast AI’s new security solution automatically updates software, including node OSes, and detects anomalies and alerts the organization.
Cast AI Node Update.
It also touches on a number of other security concerns, including software misconfigurations. The human factor is always a key security worry for organizations, and misconfigurations are all about humans. According to a Black Hat report earlier this year, misconfigurations were a top human-related security threat, from forgetting to change a default password on a server to copying and pasting configurations from one serverless function to another.
Cast AI’s KSPM helps DevOps teams identify and correct errors.
“That’s the beauty of focusing on fixing it instead of showing it,” Laurent said. “You need to show when you fix it. If you show only, I’m not interested. If you show a fix, then it’s our security product. That’s the kind of DNA we have.”
Looking at Those Third-Pary Configurations
In addition, the platform’s scanning capabilities also can validate third-party configurations, according to Giri Radhakrishnan, director of product marketing for Cast AI. In a blog post, he noted that “Kubernetes is an ecosystem in which teams frequently borrow or import resources from upstream. For example, you can retrieve container images from a public Docker Hub registry or use a GitHub deployment file. These third-party developers that build such resources may or may not adhere to the same security standards as your team.”
Automatically detecting misconfigurations also ensures that K8s clusters remain in compliance with the growing number of regional regulations, including Europe’s GDPR for data management and the United States’ HIPAA for handling health care data.
There also is a dashboard showing a company’s up-to-date Kubernetes cluster security status and another that shows the analysis of vulnerabilities in a cluster, along with details of the security flaws and where they are within an image. The solution also shows attack paths created by image vulnerabilities that are exposed to the internet and pose risks and steps for remediating threats.
The challenge now is making organizations and developers comfortable with automation, Laurent said. Many cybersecurity vendors say they have automation in their products, but not many security teams are using it.
“They are all afraid that by automating it, it would break something,” he said. “That’s the problem with humans. We all know that if Tesla drives your car, you’re probably safer because it will see the things you may not see. It’s controversial. It’s a machine that is driving for you. … It’s the same for cybersecurity. We all know that there are 10,000 critical vulnerabilities and then you don’t do anything. We took the opposite approach to that. Our job is to make things efficient. It’s cheaper to run. Now it’s more secure to run.”
