Protect against unknown security vulnerabilities
summary
Open-source new Vector hooks into CI/CD and registries for continuous image scanning, offers admission-control rules, and runs a node-level enforcer that performs deep packet inspection and blocks at the Linux network stack (not via Calico or k8s NetworkPolicy). Cluster learning runs in Discover Mode, moves to monitor, then to protect mode to block unknown process execs and network calls. Demo shows it learns a wget call to google.com, then blocks that process and the external connection; overhead in protect mode is about 1–2%.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:38Security in Kubernetes
- 1:35Securing the runtime
- 2:28NewVector
- 3:09Supply chain
- 7:14Runtime security
- 14:32Demo setup
- 15:07UI overview
- 17:22Containers
- 19:22Report format
- 22:52Recommendation service
- 24:17Wget
- 26:57Network Activity Dashboard
- 29:42Summary
- 30:42Questions
related talks
53mProtect against unknown security vulnerabilities
34mShift Left and Security-as-Code: Security on Kubernetes
25mFoster Secure Innovation with Your Kubernetes Platform
46mZero Effort Zero Trust K8s Security for Blocking Zero Day Attacks
52mImplementing holistic security for containers and Kubernetes
20mCloudy with a Chance of Zero Trust: Navigating Security in the...
34mCloud Native Security: A New Paradigm for a New World
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring