Securing Your Software Delivery Chain with Process Auditing
summary
Presentation demonstrates using strace to record syscalls, file accesses and forks to build a baseline profile of a legacy app and using eBPF for low-overhead streaming queries like fork rates and HTTP metrics. It says strace shows exact files but costs high overhead in production, eBPF captures ongoing events but struggles to follow process lifetime, and bpftrace truncates command lines making full audit trails incomplete. It pivots to vulnerability compassion and self‑care.
AI-written summary · about
chapters (11)
- 0:00Open Access Sponsor BLAMELESS
- 0:15SECURING YOUR DELIVERY CHAIN WITH PROCESS AUDITING
- 0:52PROBLEM How can you know more about your applications and systems? What tools are available When would you use them And how?
- 10:41EBPE TODO: process follow fork tracing? bpftrace file access output improvement!
- 11:40AN ABBREVIATED HOW determine your target build baselines surface deviance
- 15:06BEING TRAUMA AWARE
- 15:42PROCESSING
- 17:37CONSEQUENCES
- 20:05IT CAN GET BETTER (SURVIVAL IS A PREREQUISITE)
- 20:49THERE ARE WAYS YOU CAN HELP (IF YOU HAVE THE CAPACITY TO)
- 21:04do not try to deal with everything at once do not try to do it all yourself do not forget to check that the fundamental prerequisites for being not in crusts are in place
related talks
32mListen to your Engine
40mExploring Runtime Security and Forensic using eBPF
53mGetting Started with BPF Security Observability
45mStrace: Monitoring The Kernel-User-Space Conversation
20mClosing Perspectives
24mBridging BPF LSM and the Linux Audit Subsystem
20mThink eBPF for Kernel Security Monitoring
45mTrace to Triage: How to Connect Product Vulnerabilities to Security Paths