Runtime Security: Challenges & Solution Space
summary
Runtime security faces updates, staging ≠ production, false positives and performance costs; this talk presents a concrete stack and results: using eBPF and BPF LSM inline remediation to deny malicious syscalls, auto-generate policies to auto-discover Kubernetes network policies, and enforce rules that block service-account token access and prevent injected crypto miners at execution time. KubeArmor is a CNCF Sandbox project (open source, ~110 contributors) that converts YAML policies into LSM/eBPF enforcement and demonstrates effective inline hardening vs post-attack mitigation.
AI-written summary · about
chapters (10)
- 0:00Runtime security challenges
- 2:46Why runtime security matters
- 4:10Runtime security layers in Kubernetes
- 7:17Runtime security challenges
- 10:46Inline vs post-attack remediation
- 13:58CubeArmor project
- 17:24Inline mitigation with BPF LSM
- 19:12Auto-discovering network policies
- 20:59Defending against Hildegard attack
- 22:47Choosing runtime security approach
related talks
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
35mKubernetes Security - Challenge and Opportunity?
31mAutomatic application hardening by leveraging container runtime behavior analysis
28mKubeArmor: Applying Security Policies with Practical Examples in K8S
17mRuntime Security in the Cloud Native World
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
30mSandboxing Agentic AI With LSM-BPF