We’re taking another step forward in our mission to help you achieve continuous security and compliance by introducing Workload Protection.
With the release of this integration with the IBM Cloud Security and Compliance Center, IBM Cloud further expands its cloud security capabilities, enabling customers to do the following:
- Find and prioritize vulnerabilities across CI/CD pipelines, registries and runtimes.
- Detect and respond to cloud and container threats.
- Manage configurations, permissions and compliance.
What is Workload Protection?
In short, Workload Protection is a Cloud Workload Protection Platform (CWPP) that encompasses multicloud compliance and security posture management (CSPM) with threat detection and vulnerability scanning into one solution. Through the capabilities offered, customers can now have a unified view into risk across their infrastructure—be it containers, Kubernetes, or virtual or physical hosts across clouds (including IBM Cloud, Amazon Web Services, Google Cloud and Microsoft Azure). Furthermore, the service provides out-of-the-box rules to verify container and cloud compliance.
Workload Protection helps customers better understand and measure their progress against regulatory standards and leverages CIS Benchmarks for Kubernetes to provide guided remediation tips to help you maintain or quickly re-establish compliance.
How does it work?
Workload Protection ingests data from multiple data sources—including system calls, orchestrator and container audit logs, and cloud logs—to trigger alerts and enrich events with cloud, container and Kubernetes context. Insights from across your cloud environments are collected in a Software‑as‑a‑Service (SaaS) backend residing on IBM Cloud and available via an intuitive web interface to help you prevent, detect and respond at cloud speed:
Workload Protection is built on open standards for cloud-native security and control, including Falco (the open-source standard for cloud threat detection) and Open Policy Agent (OPA) (the open-source standard for Policy as Code).
What are the key Workload Protection use cases?
Workload Protection helps organizations secure and accelerate cloud innovation by providing deep visibility into cloud-native workloads and infrastructure to enable security use cases from source to run, including the following:
- Detection of OS and non-OS vulnerabilities (e.g., Python, Node and Java packages) with in-depth image scanning across CI/CD pipelines, registries and runtimes.
- Out-of-the-box policies to identify suspicious activity to detect, respond and implement requirements for compliance frameworks (e.g., PCI, NIST, SOC 2, ISO, etc.).
- Cloud workload protection (CWP) for containers, Kubernetes and VMs across any cloud provider, including support for IBM Cloud Kubernetes Service, RedHat OpenShift Kubernetes Service, Amazon Elastic Kubernetes Service (EKS), Google Kubernetes Engine (GKE) and Azure Kubernetes Service (AKS).
- Kubernetes network security validation and policy generation to help teams implement least-privilege and stop lateral movement threats.
- Compliance and configuration management to validate against policies, including CIS Benchmarks for Kubernetes platforms, OWASP Top Ten, DISA guidelines and NSA/CISA hardening guides.
- Incident response and forensics, capturing detailed activity records to investigate events and quickly respond, even after containers are no longer running.
How do I get started?
To start using Workload Protection, you can create an instance through the IBM Cloud catalog:
- Navigate to the IBM Cloud catalog.
- Select the Security and Compliance Center Workload Protection tile.
- Create an instance limited to us-east for this release.
- Deploy the agent.
- Start evaluating your resources.
For more detailed instructions, see the documentation.
Tip: If you’re working with IBM Cloud resources, you can get started directly in the Security and Compliance Center.
Feedback
In order to ensure that we are helping you to deliver on your own mission, we’d like to hear from you with any feedback that you might have. To share your questions with us, you can open a GitHub issue from a link at the top of any page in the IBM cloud documentation, open a ticket with IBM Cloud Support or reach out directly through email.
Learn more about the IBM Cloud Security and Compliance Center.