Coping with Zero Days with Cilium Tetragon
Talkat ContainerCon @ Open Source Summit Europe 2024 · on Tuesday, 2024-09-17· at 11:00· Room 0.14 (Level 0)·
summary
Cilium Tetragon uses eBPF to watch kernel events and generate filtered JSON forensic records so teams can find and respond to zero days without redeploying workloads. Demo shows a policy that detects mmap of liblzma (the XZ utils backdoor) by matching security_mmap_file and process name, then an alternate policy that kills process with SIGKILL from the kernel to stop RCE; mapping links events to pod/node context and running with under 3% CPU overhead.
AI-written summary · about
chapters (11)
- 0:00Tetragon and zero-day vulnerabilities
- 1:51What is eBPF and security
- 5:45Tetragon basics and monitoring
- 12:32Detecting zero-day exploits
- 15:20Demo: XZ utils backdoor exploit
- 20:49Blocking exploits with policies
- 25:31Runtime vs build-time detection
- 28:01Low-overhead runtime security
- 32:16Kubernetes process hierarchy
- 35:50Tetragon at scale and GitHub
- 36:58Q&A
related talks
44mCoping with Zero Days with Cilium Tetragon
42mCoping with Zero Days with Cilium Tetragon
33meBPF for Security
33mDetecting Compromised CI With eBPF and Cilium Tetragon
32mReal Time Security - eBPF for Preventing attacks
31meBPF-Driven Security for Kubernetes: The Tetragon Story
22mTales from an eBPF Program’s Murder Mystery
14mWill eBPF Save Us From the Next Global Outage?