Detecting Compromised CI With eBPF and Cilium Tetragon
summary
Shows a concrete GitHub Actions workflow that installs Cilium Tetragon via eBPF kernel hook and runs example policies in monitor and enforce mode. Demos detect and log a curl TCP connect and, when enforced, send SIGKILL so no network connection occurs; another policy blocks head reading etc/shadow while allowing sudo; a Trivy workflow separates database download from scanning to prevent post‑scan exfiltration. Example policies run live in CI and successfully detect and block the demo incidents.
AI-written summary · about
chapters (9)
- 0:00Securing CI with Tetragon
- 2:32Tetragon and eBPF
- 5:50Network exfiltration in CI
- 11:37Blocking sensitive files
- 16:58Securing Trivy scans
- 18:52Policy tampering in PRs
- 22:08Health warnings
- 23:31Resources
- 24:34Q&A
related talks
36mSecuring CI/CD Systems Through eBPF
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
32mReal Time Security - eBPF for Preventing attacks
42mCoping with Zero Days with Cilium Tetragon
44mCoping with Zero Days with Cilium Tetragon
33meBPF for Security
22mOne Project, Different Angles: How to Secure and Observe with Cilium- 44mCoping with Zero Days with Cilium Tetragon