Kubernetes Runtime Security: What Happens if a Container Goes Bad?
summary
Shows how to detect and respond when a container is compromised using system call and network hooks, demonstrates Falco running as a daemonset on GKE and alerting on a PHP reverse shell added to a WordPress container, detects an attempted crypto miner (etherminer) and fires alerts into Google Cloud Security Command Center, and compares responses like pause, restart or kill container versus isolating the pod. Includes a working demo that triggers and logs the event.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:52What is Container Security
- 5:10Why are containers different from VMs
- 6:30What are the big differences
- 8:42Why bother
- 10:35MSNMS Nifc Framework
- 13:30Monitoring Containers
- 14:05Detecting Containers
- 15:48Deployment Models
- 17:38Response
- 19:59Why are containers special
- 20:59What can you do
related talks
45mKubernetes Runtime Security
29mKubernetes Security: Attacking and Defending K8s Clusters
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
35mKubernetes Security - Challenge and Opportunity?
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
01h 24mTutorial: Attacking and Defending Kube...