osquery from a Cloud-Native and Zero Trust Perspective
summary
GitLab uses osquery as a building block of a Zero Trust roadmap, running a proof‑of‑concept that does phone home verification to attest device configuration before granting access. Lessons: front‑end hosts at scale crash RocksDB with poorly tuned packs, polling frequency and stateless diffs cause overload, orchestration with Chef creates config overwrites, and one query pack does not fit all — adopt role-specific query packs and correlate results across systems.
AI-written summary · about
chapters (6)
- 0:00Introduction to zero trust osquery
- 1:23Zero trust fundamentals and challenges
- 3:32GitLab's zero trust roadmap
- 7:57Osquery challenges and lessons learned
- 16:52Device authorization with osquery
- 20:39Summary and future plans
related talks
40mBeyond Endpoint Security Using Osquery at Scale
20mLeveraging Osquery for DFIR at Scale
01h 02mIntroduction to Zero Trust Security
19mSecuring the endpoint with open software
22mIntrospecting your machines with osquery
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
26mTaking Your DevOps Tooling To The Dark Side
25mBuilding a DevOps Supply Chain on Zero Trust Principles