Keynote: Security and the OODA Loop
summary
Maps the military OODA loop onto Kubernetes reconciliation and shows a tracer that lists executables inside pods, confirming nginx versus a downloaded "bad" YAML that runs a malicious script. A simple detector matches the executable name "bad" and deletes pods, but controllers immediately recreate pods so the malicious action prints to logs before deletion and the cycle continues. Conclusion: stop bad images earlier by scanning at build time, enforce RBAC and use admission controllers or Open Policy Agent to block intent.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:30Detecting anomalous behavior
- 5:17Detecting bad executables
- 6:57Faster is better
- 7:18Conflict with Kubernetes reconciliation loop
- 7:56Preventing bad actions
- 8:07Better OODA loop
- 8:27Other opportunities
- 9:06Preventive measures
- 9:55Runtime security
related talks
12mKeynote: Security and the OODA Loop - Liz Rice, Technology Evangelist, Aqua Security
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
41mKubernetes Security Jumpstart
43mKubernetes Security: Attacking and Defending Modern Infrastructure
22mSecuring Kubernetes
04mTalk Deep Dive
35mKubernetes Security - Challenge and Opportunity?
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security