Skip to content
0:00 / 0:00

#kubernetessecurity#detectionengineering#ebpf

BSidesSF 2024 - Effective Detection in Kubernetes Clusters (Shay Berkovich, Oren Ofer)

Security BSides San Francisco

6.4K subscribers • 2 videos on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Presented by Shay Berkovich and Oren Ofer

Intermediate. Assumes working knowledge.

298 views2 years ago1 recommendation

SecurityCloud and DevOpsKubernetesWeb and application securityExploits and vulnerabilities

Shay Berkovich and Oren Ofer explore cluster event sources and cloud interfaces to design high-coverage security detection rules for Kubernetes.

Effective Detection in Kubernetes Clusters Shay Berkovich, Oren Ofer Kubernetes attacks are on the rise and defense needs to up its game in response. In this talk we explore cluster event sources, assess cluster-cloud interfaces, and suggest useful rules to lay out an efficient and high-coverage detection solution for production K8s clusters. bsidessf2024.sched.com/event/de2e236fe6000a973e578cde3b1a15b…

Why it's here

1 person recommends this

What people say. Recommended as a useful resource for understanding and explaining Kubernetes network traffic and security detection.

u/ApprehensiveDot2914in r/kubernetes • Recommends

On “How to explain K8s network traffic internally to long term security staff?”

…where all your workloads are. A CNI like Cilium can also be used to collect networking logs. - https://github.com/cilium/hubble Here’s some useful resources for them 1. https://www.wiz.io/blog/unveiling-ebpf-harnessing-its-power-to-solve-real-world-issues 2. https://securitylabs.datadoghq.com/articles/kubernetes-security-fundamentals-part-6/ 3. link to this video…