Simplifying Container Runtime Security: Nirvana Infotech's Journey with evaluating solutions
Published: 2023-06-09 03:45:00

**Introduction**:
Nirvana Infotech is on a mission to secure the multi-cloud workloads of our clients, for whom we build, run, and deploy applications. Recognizing the importance of a robust container runtime security solution, we set out on an adventurous journey. This blog recounts our experience and unveils our discovery of solution offerings from various vendors. We hope that this helps our clients as they consider us for managing their cloud native workloads. 
 
**Section 1: The Challenge of Securing Multi-Cloud Workloads**
In today's digital landscape, effectively securing containerized workloads across diverse environments, including on-premises infrastructure, AWS, GCP, and Azure, presents a complex challenge. That is the World we live in each day where our clients demand multi-cloud application deployment, management, and security solutions from us. Additionally, the proliferation of open-source libraries further adds to the complexity. Nirvana Infotech sought to identify the best cloud native application security solution, which includes runtime container security, CI/CD security of container image scanning, and API security solution to ensure the safety and integrity of our clients' multi-cloud, multi-cluster applications.
 
**Section 2: Exploring the Available Options**
In our pursuit of an ideal solution, we meticulously explored various tools and solutions in the market. Our primary focus was on finding a solution that provided comprehensive insights and enabled a quick start without unnecessary barriers.
 
**Section 3: Experiences with vendors **
**_3.1 Prisma Cloud_**: Promising but Complex to get started
Our exploration began with [Prisma Cloud] (https://www.paloaltonetworks.com/prisma/cloud), a solution that demonstrated significant potential with its extensive feature set and marketing documentation online. Our talks with the account team were great. However, we encountered complexities when attempting to initiate our evaluation. There was no free trial. It feels like a disjointed set of offerings with all its acquisitions. We did not feel that its a seamless platform. The requirement of reaching out to hear their sales pitches and awaiting approval hindered our objective of seamless and rapid implementation that our clients want from us. 
 
**_3.2 AWS GuardDuty_**: A Popular Choice with Limitations
Next, we turned to AWS's built-in GuardDuty for EKS, a favored option among cloud-native practitioners. While [GuardDuty] (https://aws.amazon.com/guardduty/) offered robust security features, we faced challenges during the testing phase. It fell short of our expectations in identifying potential vulnerabilities within our intentionally vulnerable test bed application. We discovered that fully leveraging GuardDuty's capabilities necessitated additional configuration and adjustments, potentially posing a barrier for our clients seeking a user-friendly and effortless solution. And the fact that it only is applicable for AWS environments, not multi-cloud and hybrid environments like the ones we deal with for our clients.
 
**_3.3 Laceworks:_** Another Popular Choice with Steep Price Point
Next, we turned to [Laceworks] (https://www.lacework.com/), a solution that promises everything and the kitchen sink when it comes to Cloud Native Application Security. It fell short of our expectations upon the PoC experience - there was no support for API Security, nor was there any opportunity to trial the software in a self-service manner. From the reviews online we noted that, like Prisma. It's other features were good. Their price point was steep. Their UI had a number of different areas and was complex and non-intuitive. It had limited integrations with cloud services and providers.

**_Section 3.4: Snyk_**
 We loved our experience with [Snyk] (https://snyk.io/), especially its ability to have a plugin to the IDE to provide immediate view of public CVEs related to our code, with many language bindings available. Truly a game changer for our practice. Its self-service free trial was well designed, and allowed us to show value to our clients immediately. It did not have pricing listed clearly on the website, which hindered our evaluation. Snyk not only identifies vulnerabilities but also provides actionable remediation guidance to help developers fix the issues efficiently. It offers step-by-step instructions, code examples, and even fix pull requests for open-source projects, simplifying the process of resolving vulnerabilities. Snyk offers seamless integrations with popular development and DevOps tools in our client environments like Gitlab, GitHub, Artifactory, Jenkins, and Harness, enabling easy adoption and integration into existing workflows. It integrates with tools like IDEs, CI/CD platforms, source code repositories, and issue tracking systems like Atlassian JIRA, which we liked. Snyk's overall focus on developer experience, comprehensive language and ecosystem support, continuous monitoring, integrations, and remediation guidance made it a suitable choice for us to recommend to our clients. 

**Section 3.5: Cisco Panoptica**
During our exploration, we found Cisco’s [Panoptica](https://panoptica.app/) solution for Cloud Native Application Security. It is a relatively new entrant. We saw a blog post and learned of its existence, and finally landed on their website that began our journey to learn more about Panoptica. Panoptica promises a solution for Application security including API Security, which was great. We were delighted to find that Panoptica offered online free trial to help us evaluate quickly. This developer-friendly approach, similar to Snyk, allowed us to focus on securing our clusters without unnecessary barriers. It took us a while to figure out how to connect our cluster by reading the docs. But we were up and running and had connected our clusters. Since the free trial only allows connecting with 1 Kubernetes cluster, we upgraded to Pro tier to test out multi-cluster, multi-cloud scenario that is prevalent in our client's typical use case. The upgrade path was easy online avoiding the hassles of a paid PoC. A few clients have asked us about protection against OWASP top 10 API vulnerabilities - we plan to investigate Panoptica further for those use cases.  
 
**_4 Key Benefits and Features of Snyk and Panoptica_** 
Intuitive User Interface and Comprehensive Reports: Snyk and Panoptica's user-friendly interface and detailed reports provided us with a clear understanding of our containerized workloads' security posture. This empowered us to effectively prioritize and address vulnerabilities, while continuously monitoring and receiving real-time alerts to stay ahead of potential threats. Snyk has a strong emphasis on remediation and offering learning about CVEs, but Panoptica was able to detect and prioritize vulnerabilities once we connected our cloud accounts and k8s clusters.
Integration with Any Kubernetes Cluster: Panoptica offered a lot more choices than Snyk to integrated with any Kubernetes cluster (AWS, Azure, GCP, on premises, etc). Panoptica offered an intuitive topology view. This streamlined approach eliminated the need for multiple security tools and intricate workflows.
Robust Vulnerability Assessment: Snyk offered a lot more education about the vulnerabilities it found, demonstrating a profound understanding of the challenges posed by open-source components. Both solutions continuously scanned for vulnerabilities in open-source libraries, ensuring the protection of our applications from potential security risks.
Additionally, Panoptica has a transparent pricing model, available on their website, which enabled us to model predictable costs for our clients. I hope that other vendors follow suit as these two.
 
**Section 5: Conclusion**
In summary, our experience with both Snyk and Cisco Panoptica have been good. I wouldn’t say it has been totally seamless, but much better than other options we explored. They both helped improve security posture of our microservices apps consisting of container images and runtime in EKS and AKS clusters, serverless functions, and external APIs.  It improved our container runtime security practices, equipping us with the necessary tools and insights to effectively safeguard our clients' Kubernetes workloads. Their alignment with our developer-focused mindset, combined with its hassle-free free trial and transparent pricing, made it the good fit for us to deliver value to our clients quickly.