Security

Review: CrowdStrike Falcon Can Protect Any Cloud at Any Time

Designed for resource-constrained environments, this tool can help smaller IT teams cover their entire cloud security landscape.

John Breeden II

Twitter

John Breeden II is an award-winning reviewer and public speaker with 20 years of experience covering technology.

Hospitals and other medical facilities generally don’t have unlimited IT resources to fully protect their ever-growing cloud environments. Their internal security teams must usually focus on existing threats and don’t have enough time or personnel to devote to potential attacks, vulnerabilities and overall security monitoring. Attackers know this, which is why ransomware and other cyberthreats are on the rise in healthcare.

The CrowdStrike Falcon cloud workload protection platform aims to help out, providing Cybersecurity Monitoring as a Service along with deep scanning for vulnerabilities and other potential problems. It’s designed to discover every change occurring in a cloud-based infrastructure, which also makes it a valuable tool for advanced threat hunting and post-attack analysis. It helps before, during and even after an attack.

Click the banner for access to exclusive HealthTech content and a customized experience.

Cloud Workflow Protection With Easy Setup, Strong Protection

CrowdStrike follows an internal guideline for most of its products called the 1-10-60 rule. That rule states that good cybersecurity in dynamic environments such as healthcare requires that attacks are detected within one minute, triaged within 10 minutes and mitigated within 60 minutes. That does not give cybercriminals, who can sometimes linger in unprotected systems for months on end, enough time to launch any major attack, outside of possibly compromising a single endpoint.

Setting up the Falcon platform is easy. It automatically discovers existing cloud workload deployments and can do so without installing an agent by using Amazon Web Services EC2 instances, Google Cloud Platform compute instances and Microsoft Azure virtual machines.

You can point Falcon at clouds of all types, including public, private and hybrids, hosted by Google, Amazon, Microsoft or others. It also works for containerized environments.

In testing, it was able to detect even small changes within a cloud infrastructure and analyze whether that change was normal or potentially malicious. Potentially harmful changes can be automatically fixed or put on hold and sent to staff for further analysis.

A Security Platform Ideal for Healthcare Integration

Falcon does more than just monitor production environments in the cloud because it can also integrate into the development of hospital software. From there, administrators can set specific security and image policies, and only allow compliant new software and updates to proceed to production.

Since Falcon easily integrates with Jenkins, Bamboo, GitLab and other development toolsets, it makes for a perfect companion for DevSecOps or continuous integration/continuous delivery efforts.

With the CrowdStrike Falcon platform, hospitals and medical facilities have a force multiplier for their existing security teams and a partner that constantly monitors all their cloud environments, from development to deployment.

SPECIFICATIONS

PRODUCT TYPE: Cloud security and monitoring suite
WORKS WITH: All cloud types and containers, all major cloud providers
THREATS MITIGATED: Ransomware, credential stealing, data theft, zero-day attacks
ENVIRONMENTS PROTECTED: Production and development
EXTRA FEATURES: Deep threat hunting

Inoculating Containers Against Cyberthreats to Healthcare IT Environments

Containerized environments are sometimes left out of the security picture, but not with the CrowdStrike Falcon cloud workload protection platform.

Many organizations are turning to containers for their cloud computing infrastructure. Containers have a lot of advantages, such as the ability to move easily across environments and hold down resource usage on hosts. Each container is generally a self-sufficient environment able to perform either simple or complex functions as part of the greater cloud environment. That makes them easy to deploy and use, but they are sometimes tricky to monitor.

The CrowdStrike Falcon platform includes monitoring containers as part of its core functionality. It does this by installing an agent on the container host, which can protect an unlimited number of containers running there. Any new containers that move into that environment are automatically protected.

I tested it with the Docker container environment, but it is designed to work with any that comply with the Linux Open Container Initiative standards.

Within the container environment, Falcon can do a lot in terms of enforcing good security policies. For one, it will flag any hidden threats in open-source or third-party packages, which is how a lot of dodgy code gets into a container and prevents it from running.

It also monitors and captures every single event occurring in every container, including stops, starts and all runtime information. If a threat or an attack is detected — like one that makes a major change to a container — it can take automatic actions to halt that event and prevent it from spreading to other containers. It also provides a complete forensic record, including detailed aspects such as any commands typed by a human, to fully analyze what happened and prevent it in the future.

The platform also provides good insight about the overall health of the container environment, including usage and uptime, which can shed light on how a sometimes mysterious and independent containerized environment is performing.