Runtime Policies - Feat. KubeArmor and Falco (You Choose!, Ch. 3, Ep. 2)
Source: YouTube · DevOps & AI Toolkit · published Jan 17, 2024 · 58:21
This video explores runtime security policies for Kubernetes clusters, focusing on what happens after containers are already running 0:17-0:35. The hosts discuss how runtime security differs from admission controllers, which operate at the API level and can't detect misbehavior inside running containers 0:44-1:03.
Key Takeaways:
• Runtime security monitors processes inside containers at the kernel level, detecting behaviors like unauthorized file access or privilege escalation that admission controllers miss 16:00-17:03
• Falco collects system calls at the kernel level using eBPF and applies rules to detect threats, with plugins extending capabilities to Kubernetes audit logs and cloud events 30:58-34:37
• KubeArmor provides inline enforcement using Linux Security Modules and eBPF, blocking malicious activities immediately rather than just detecting them 37:41-38:22
• Both tools work complementarily - admission controllers prevent bad configurations, while runtime security protects against container misbehavior and exploits 43:28-44:06
The video demonstrates how these tools create a layered security approach for Kubernetes environments, with both detection and prevention capabilities 35:42-35:49.
Sources:
- 0:17-0:35 Explains runtime security focus vs admission controllers
- 16:00-17:03 Describes monitoring processes at kernel level
- 30:58-34:37 Explains Falco's eBPF-based threat detection
- 37:41-38:22 Demonstrates KubeArmor's inline enforcement
- 43:28-44:06 Describes complementary nature of security tools
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello it's us you CH it's us welcome this is you Chu it's a Choose Your Own Adventure style show where we're navigating our way through the entire cncf landscape and today what are we what are we talking about today Victor today we will be talking about runtime policies or security right what is happening inside your in this case cetes cluster right not how do you pre prevent things from getting in but what happens when they're in what what happens when they're already there when they snuck in when our admission controller policies from last week didn't catch it right uh not only didn't catch it right admission control admission controllers are not going to catch many of the things because many of the things are not really in domain of admission controllers are not catchable from the API l…