Hello everyone. Welcome back to my
NetSack YouTube channel. In today's
video, I'm going to show you a little
bit about the Tinabo product cloud
security. I had a chance to work on this
product recently and I really likes it.
I do see lots of potential for this
product. I used lots of tinable product
NES vulnerability management web
application scanning those kind tools
cloud security seems it's a new product
coming and two years ago October 2023
Tinbo acquired
with a price 265 million you do able to
see those blog post regarding this
acquisition machine. So, let's get
Dinable get into the cloud security
market. I believe they are still working
on it, but they already became pretty
good now. So, that's why I decided to
make a video for it. Just show you how
it looks like. This is the portal, the
documentation side. Even with the
documentation side, you won't be able to
access it directly.
So it does require you login first and
then you can work on
for now. Um let's jump into it. I'm
going to give you an example how it
works with Azure infrastructure which
I'm going to present it in this video.
just show you basic idea how it's
working, how the integration works, how
it can use to scan your whole as your
infrastructure.
There are not many documentation or even
videos to show this product. Um, I'm
going to using this opportunity to just
quickly show some basic idea, basic
steps how you can get this product to
scan your cloud infrastructure.
There's a quick start guide,
we won't be able to go through it.
Um since we are going to using Azure as
a example so I'm going to more to show
you how we can connect into as your
environment.
There's something you need to know is
about the license.
There are different type of license in
tino jit cm. I'm using standard as
example. Um but uh there's a difference
between standard and the price of course
enterprise is highest license you can
get. Uh from what I can tell not much
difference mostly will be covered by
standard. It does have some different
with admission controller for the
KSPM part. It also has little bit uh
difference on the scan workload on site
but since we are using cloud so this
won't make much difference. If you want
to scan Kubernetes workload uh you can
through the agent uh we are not going to
use in agent list scan for Kubernetes.
So this won't make much difference here
again.
So there are two type of uh scanning
agent list and agent base scan for
kubernetes.
In this video I'm going to focus on
agently scan. So now let's go to tinable
cloud security and start the
integration.
Now we are in the tinable cloud security
dashboard. We are new here. That means
we don't have any cloud environment
added in. For this lab, we're going to
add a zoo environment.
It's better you have globin row. So you
can finish all your lab here. Go to the
settings. There are couple ways to add
it.
account
integration.
There are lots of integrations you can
do. Of course, you can integrate with
cloud providers. You also can integrate
identity providers. If you add as your
organization,
then they will ask you Microsoft and ID
tenant. So basically you need to add
your tenant ID first.
So click here to add it before you
proceed to add your organization.
So you can add it here. If you don't
want to do that same thing, you can go
to the integration here uh ID then add a
Microsoft N ID. You can come here. So uh
I'm going to using the NAC as my Nid T
name. So this is public of course
depending on the domain.
So if it is on your domain or maybe I
can add another Microsoft Android tenant
since we are using different
Android tenant that my user belongs to.
So grant
so I'm going to pick this account. So
permission requested they are view read
all reader permissions you need to give
to this tinable cloud security connector
remember this we're going to use in that
later on
again it's better to use global admin
account to do this kind of integration
because there are lots of permission
need to be granted
here it says consent is required to add
tenant.
In that way, we're going to go back to
our entry ID page here. Let's look at
our enterprise applications.
So, you will see this Tinable Cloud
Security connector. That's the one we
just added in. We grant the permission,
but we didn't grant admin consent yet.
So that's why we coming here
properties
permissions
grant admin consent for default
directory. Let my directory default
directory. Okay.
Grant consent. Login again.
Accept.
So we already granted through admin
consent grant and administrator all have
been granted. Now we can try to add it
again.
Tenant ID.
It's working well table cloud security.
Perfect.
Now we add Microsoft antid tenant.
It's connected. So it does take a little
bit time. We did twice grand admin
concerned to get this Android ID added
into our subscription. If you met this
issue uh which asking you to grant admin
consent even you did it so just do it
again. Next step we're going to do the
organization.
So let's go to the settings again.
Integrations
as your organization.
Add as your organization.
So what we going to do is we're going to
pick the entry id
connect to then go to next step
organizations details we gave it the
name as a net sec which automatically
already giving it automatically update
the management group structure okay so
here is a permission for future so we're
going to enable all no matter what we
are testing it so why not we're going
going to have monitoring read only.
We're going to have data resource
scanning workload protection remediation
just in dynes
or permissions. What this page will do
is it's going to ask you to grant
different permissions based on your
selection. So if you just want to do
workload protection that probably just
very specific permission you will need
but since we are testing we get
everything in here is an interesting
part there's different way you can do
you can using ARM you can use in
powershell you can use manual through as
portal to grles for your app let's do
this one
of course we is saying
tin already make this very simple to do
um
ten and loot group you don't have
authorizing perfor action
management group let's take a look what
the management group we have
so we have one subscription
but on it we have couple of management
groups
for those three management group we
don't have any subscription with it.
So for now to say we're going to add our
subscription into this management group.
So in this case we can choose this
management group PD.
Let's refresh it. Okay. Perfect. So let
me come back here. We can choose product
region.
So principal ID
Linable cloud security connector
application service principal ID let's
go back to as you would to get that
property
basically that's the object ID
so we're going to copy that
we're going to put it in
Um here's a permission we give true
since we need all of them.
Next
10 resources create. So we submiting
the deployment. Now deployment is in
progress.
Okay. Go to management group.
Yeah, that's the same principle ID
create. Wait until deployment is
completed. Okay. Um, by the way, if you
want to do it manually, you can see what
you will need to do. You can come into
manual as your portal. uh you can use in
portal to assign roles to tin cloud
security connector
and you will need to create a custom
rule as well. So this maybe we can
verify that in the future but anyways we
use the ARM as your portal to finish
that. Go to next
which is much simple.
So we're going to sync all calendar
future subscription
organization has configured
successfully. They have some warning. Um
it's lo assignment are missing on the
load management group. Uh which are
fine. We don't have to do it because we
gave it to uh we only have one
subscription. We gave it to a specific
management group POD plot. So we should
be good here.
Then we can close
connect it. See this one. Add it. If you
want to change anything here, uh you you
will be able to do that. You also can uh
verify the permissions rules we grant
to.
So everything looks good.
If now you go back to dashboard, you
will see this. We are currently
processing data in the account. Stay
tuned. What it's going to do is atttor
and connecting to your environment and
then starting to do the asset discover
for each asset they found. If it's in a
scope, let them do risk analysis and
threat detection, compliance check,
vulnerability scanning,
all those things. They're going to find
out the misconfigurations,
vulnerabilities, outdated components and
permissions or any non compliance
configurations and then give you the
visualized report to show you what the
finding is. So it might take a couple
hours to get it done. Uh so we're going
to come back and uh I will show you
result once that done.
It has been 2 hours uh since I started
the cloud security scanning to my Azure
infrastructure. Um now you can see we
did get some findings. There's no
critical there, median and the low
findings. Um I'm pretty sure the
scanning is still ongoing. So um here is
a scanning method. We are using agent
list scan. Uh you do able to use agent
basis analysis
uh scanning
for workload protection
for the WMS. It says
uh tinable attempt to scan every virtual
machine as soon as 24 hours have elapsed
from the previous scan.
But the first scan usually taking faster
couple hours for Kubernetes or for the
data even probably going to take a
longer time to get the scanned. Uh we
can take a look at data protection.
every two to seven days. So let's uh
data scan frequency.
We can take a quick look at the
like virtual machines. You will see here
we have a couple virtual machines, Linux
test one and the Windows test one. And
also we have Kubernetes VM here.
There's a cloud finding page that will
show you all findings
storage account managed disk
and ID delayed SQL server
storage account defender.
So there's quite bit findings here which
going to give us an idea how your cloud
infrastructure looks like.
If you go to explorer, you can see uh
virtual machine image container software
and the kubernetes clusters softwares
here. It's still nothing. I believe it's
still scans eventually what shows up.
Data resources uh that's storage
account. SQL my SQL server is here
identity related
uh quite a bit critical
permission
which we need to take a look
Kubernetes cluster which is a
interesting one. It shows missing
permissions.
So uh it might be not fully granted the
right permission. We need to double
check but that will be a different
topic. So we are using agent list uh
scanning. So but uh it does support
using helm to install agent on it and
you can la the command
uh it's missing kuberneti connector. So
we're going to create one um but not on
this video uh we're going to talk about
in the future. This is a settings page.
You can tune the settings for your cloud
security related topics here.
Now we got the cloud findings. We got
the lab permissions. Not nothing here.
Vulnerabilities. Still nothing to show
up. It takes some time. Malicious files.
I don't think there's any. Uh CICD, we
didn't configure config integration yet.
Here policies. Uh we don't have anything
but we do have built-in policies here.
Um you can tune that and enable based on
the environment you are using. You can
custom your policy. Add a custom policy
here.
Operation this is automation. Uh we
don't have anything yet. Report. You can
create your own report and then you can
schedule it to run.
There's an interesting icon here says
focus view. So you can see your cloud
security overview for your cloud
security inventory
uh cloud findings
and also you can do like data security
to see all everything relating to your
data. Uh that's pretty much everything
for this video. just show you basic how
tinable cloud security can be easily set
up to integrate with your Azure
infrastructure. I hope you enjoyed it.
Give me a thumb up and subscribe my
channel if you haven't. Thank you very
much and see you in my next one.
My baby my my
money.