Full Report
New Wiz capabilities protect containerized applications by bringing deep cloud context and visibility to quickly identify and prioritize risks across containers, Kubernetes and cloud environments without agents
Analysis Summary
This analysis focuses on the capabilities described in the provided text, which details new features for the **Wiz Security Platform** concerning cloud-native security, specifically for containers and Kubernetes environments.
# Tool/Technique: Wiz Security Platform (New Container Capabilities)
## Overview
The Wiz platform has released new capabilities designed to bring deep cloud context and visibility to containerized environments (Kubernetes, containers, cloud infrastructure). Its primary purpose is to enable security and development teams to rapidly identify, prioritize, and remove risks by correlating vulnerabilities, configuration issues, and network exposure across cloud and container boundaries using its unified Security Graph.
## Technical Details
- Type: Tool (Cloud Security Platform/Agentless Scanner)
- Platform: Cloud Environments (AWS, GCP mentioned for integration), Kubernetes Clusters, Container Images/Hosts
- Capabilities: Agentless visibility, risk correlation via Security Graph, admission control, lateral movement path analysis, KSPM.
- First Seen: Not specified (Update to existing platform)
## MITRE ATT&CK Mapping
The described capabilities primarily relate to **Defense Evasion** (via preventative controls) and **Detection** across various stages of the attack lifecycle, focusing on hardening and posture management rather than active exploitation.
- **TA0001 - Initial Access** (Prevention via guardrails)
- **T1593 - Ingress Tool: Direct Access** (Preventing exposed containers)
- **TA0003 - Persistence** (Configuration management)
- **T1543.003 - Create or Modify System Process: Cloud Service** (Preventing malicious deployment configurations)
- **TA0005 - Defense Evasion** (Identifying hidden risks)
- **T1027 - Obfuscated Files or Information** (Identifying exposed secrets/vulnerabilities within images)
- **TA0012 - Collection** (Preventing data exfiltration paths)
- **T1530 - Data from Information Repositories** (Identifying paths to data stores)
- **TA0014 - Lateral Movement** (Mapping pathways)
- **T1578.003 - Modify Cloud Compute Infrastructure: Kubernetes Cluster** (Identifying K8s to cloud movement paths)
## Functionality
### Core Capabilities
- **Security Graph Correlation:** Uses a single graph combining data from cloud APIs, Kubernetes APIs, and container hosts to calculate and correlate risk factors (internet-facing containers, vulnerabilities, permissive identities, secrets).
- **KSPM (Kubernetes Security Posture Management):** Continuously assesses Kubernetes clusters for misconfigurations using built-in/custom policies without requiring agents inside the clusters.
- **Lateral Movement Path Identification:** Identifies chains of movement between Kubernetes clusters and the cloud layer (and vice versa) leading to high-value assets (admin identities, crown jewel data stores).
### Advanced Features
- **Admission Controller:** Integration with Kubernetes clusters to block misconfigurations from reaching clusters during deployment based on unified security policies spanning build to production.
- **Cloud/K8s Integration:** Seamlessly integrates findings from external services like AWS GuardDuty and GCP Security Command Center, prioritizing them with the full context of the Wiz Security Graph.
- **Proactive Risk Reduction:** Enables security posture checks early in the pipeline (pre-production image scanning).
## Indicators of Compromise
Since Wiz is a defensive, investigative, and preventative tool, it does not inherently generate traditional "Indicators of Compromise" used for active threat hunting. Instead, its output indicates potential pre-compromise states or active attack paths:
- File Hashes: N/A (Focus is on metadata and configurations, not malware binaries)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: Identification of paths involving communication to or from exposed containers/K8s environments. (Actual paths are proprietary output, but the function is **detecting** exposure leading to paths like data exfiltration or cryptomining attempts).
- Behavioral Indicators: Overly permissive container identities, exposed secrets, internet-facing containers, identified lateral pathways between cloud and K8s.
## Associated Threat Actors
Wiz does not target specific malicious threat actors but provides defenses against various attackers attempting:
- Data exfiltration from cloud data stores via container compromise.
- Cluster hijacking (e.g., for cryptomining or ransomware deployment).
- Exploiting misconfigurations in cloud-native environments.
## Detection Methods
Wiz's capabilities are detection and prevention mechanisms themselves:
- **Signature-based detection:** Applicable when scanning known vulnerable images (CVE association).
- **Behavioral detection:** Identification of access patterns (lateral movement paths, secrets exposure).
- **YARA rules:** Not mentioned, focus is on configuration and context analysis.
## Mitigation Strategies
- **Prevention/Guardrails:** Implementing the Wiz admission controller to block non-conforming deployments.
- **Posture Hardening:** Addressing cluster misconfigurations identified via KSPM functionality.
- **De-risking:** Prioritizing remediation based on end-to-end attack vectors combining multiple risks (e.g., vulnerable image + cloud exposure + administrative identity access).
- **Agentless Scanning:** Utilizing the platform's agentless approach for comprehensive, low-friction visibility across decentralized environments.
## Related Tools/Techniques
- **Container Security:** Traditional container security solutions (which Wiz claims to augment/replace due to lack of holistic context).
- **KSPM** (Kubernetes Security Posture Management).
- **Cloud Security Posture Management (CSPM)**.
- **AWS GuardDuty** and **GCP Security Command Center** (Integrations utilized for enriched context).