Analysis of Falco Project with the Performance of eBPF and Nomad Orchestrator

Abstract

Cloud computing has become widely used technology in software and many other industries. This is because cloud computing easily, with low effort, delivers computing services like storage, process power, networking etc. With lower cost compared to traditional ways, cloud computing provides higher scalability, faster computational speed, and productivity. Cloud computing’s high usage also raised the concern about its security aspects. A lot of professionals in this area are dealing with the security of containers in order to protect their systems. There are various ways to deal with keeping a speed with cyber-attacks. One of the great practices is offering data to different associates in the cyber security area. In spite of the fact that it may very well be not generally conceivable to share occurrence data, there are adequate instances of sharing data about cyber-attacks and one of them is the MITRE ATT&CK. The purpose of this thesis is to increase the deployment performance and enhance security rules of one of the widely used run-time security tools of the Falco project. Additionally, Nomad Orchestrator support will be added. To do that, MITRE ATT&CK’s newly founded techniques for protecting containers and their environment from cyber-attacks will be used. These freshly added techniques have not been added to the Falco Project and their addition will provide better safety among the containers. In addition, Nomad’s working environment will be analysed and related changes will be done on the Falco Project.