COPENHAGEN, Denmark—Container security startup StackRox announced that it is updating its namesake platform on Oct. 16, providing enhanced capabilities to help organizations secure container and microservices deployments. The new release coincides with the DockerCon EU conference, which runs here Oct. 16-19.
As a company, StackRox, emerged from stealth in July, after three years of development, building an adaptive threat protection platform for container workloads. The StackRox 1.3 update benefits from months of customer engagement and production deployments.
“We’ve seen a number of different attack vectors—code injection, data exfiltration, lateral movement, container hijacking, etc.,” Wei Lien Dang, our vice president of product at StackRox, told eWEEK. “Also, every organization we come across is running vulnerable apps in containers.”
With the enhanced detection rules in StackRox 1.3, the company is providing a mechanism that makes it easier for organizations to build rules for secure container deployment. Dang said the new rules are very simple to configure, using the wizard-like layout. Additionally, there are now new types of threats that StackRox 1.3 is able to identify.
“We’ve added the ability to easily identify new indicators and patterns of threats such as command and control communication, in addition to simplifying the workflow for customers,” Dang said.
Also added are data pipeline services that take a broader look at the attack surface. The data pipeline capabilities include new microservices that process, analyze and detect threat indicators across filesystem and network activity and are used to apply the new detection rules in StackRox 1.3, according to Dang.
Overall policy management is getting a boost as well, with a more flexible approach to correlating potential threat indicators. Prior to StackRox 1.3, the platform correlated threat indicators based on a user-specified time window. In the new update, the time window for correlation is now open, such that long-lived attacks that could occur over weeks or even months can be detected.
StackRox is now also looking at potentially integrating the Kubernetes Grafeas metadata project, which was announced by Google and its partners on Oct. 12. Grafeas is a multi-stakeholder effort to improve container security with improved auditing capabilities.
“It is an interesting project, and Google is one of our partners, so we’ll be looking to see how we can best take advantage of the project for our customers,” Dang said.
Looking forward Dang said StackRox will continue to add new threat detection capabilities and advance its approaches to machine learning. Since coming out stealth, Dang said the response has been positive and the company has been busy with customer deployments including a large financial services firm, a major government agency and a publicly traded tech company.
“These customers are moving containers into production with an increasing focus on security,” Dang said. “One of our customers had an incident, which shows how fast the threat landscape is changing for container environments.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.