StackRox today added new runtime security features to its Kubernetes Security Platform that aim to streamline analysis, investigation, and response for runtime security events in containers and Kubernetes environments.

The cloud-native security platform provider collaborated with its intelligence community customers – who, according to the announcement blog, demand the toughest requirements – and some of its biggest enterprise customers to enable analysts and incident responders to detect and hunt down critical event details and perform forensics after a suspected incident has occurred. 

New additions to the platform include timeline views for a chronological visualization of runtime events; analyst notes to annotate metadata on alerts and security events for enhanced collaboration; and advanced policies using Boolean operators to add and combine different criteria within each policy. 

“Incident analysis and response is challenging given the immutable and ephemeral nature of containers,” said Hillary Benson, head of product at StackRox, in a prepared statement. “The large, complex environments that are prevalent among our customers accentuates the challenge, and most analyst and incident response teams have had to craft their own ways to synthesize event data. These new capabilities and workflows do away with the manual processes that bog down effective [incident response].”

In other words, it now has better capabilities to monitor performance, identify problems, and provide analysts and incident responders with tools to make more informed security and compliance decisions. 

To support its intelligence community customers, StackRox also added federal benchmark checks for container-specific compliance checks for the National Institute of Standards and Technology Special Publication 800-53 (NIST SP 800-53) – a non-regulatory agency of the U.S. Commerce Department that champions innovation and science through the promotion and maintenance of a set of industry standards. The addition of federal benchmark checks will “support Defense and Intelligence Communities, federal agencies, enterprises and cloud service providers participating in the Federal Risk and Authorization Management Program (FedRAMP)," according to the blog post.

Container orchestration is hard enough – yes, we’re looking at you Kubernetes – but properly securing container and Kubernetes environments catapults deployment into another universe of complexity. However, Kubernetes is not entirely at fault – after all, it does take two to tango.

Findings from StackRox’s “State of Container and Kubernetes Security Report” earlier this year indicate human error and misconfigurations are the primary culprits for Kubernetes security snafus.

Exposures and data breaches due to misconfigurations — a result of human error — trump all other security concerns in what StackRox said has become an “alarmingly common” trend. Findings from the survey present a clear indication that organizations are risking the core benefit of faster application development and release by not ensuring their cloud-native assets are built, deployed, and running securely. 

StackRox’s Kubernetes Security Platform aims to help DevOps and security teams communicate more efficiently and accurately visualize all deployments and pods across namespaces and clusters. To do this, it leverages deep integration with Kubernetes to deliver visibility based on insights from code deployed on its platform. The platform previously provided only an image-based view of containerized environments.