Trace to Triage: How to Connect Product Vulnerabilities to Security Paths
summary
Shows how eBPF-based instrumentation plus OpenTelemetry traces and continuous profiling turn runtime data into concrete triage answers: which service, what code path, which DB calls, and what cluster/namespace is affected. Demonstrates a vulnerable microservice demo with a five-line RCE exploit expanded by an LLM and uses traces plus sampled stack profiles to map attack flow, surface the exploited template+process spawn, and speed incident prioritization; notes production rollout often hits ~1% coverage.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:02Speaker introduction and context
- 3:09Day zero security challenges
- 8:10Automating application inventory
- 17:03Prioritizing security findings
- 22:21Using profiling and tracing for triage
- 30:09Live demo of RCE and response
- 36:15Q&A session
related talks
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
32mListen to your Engine- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
26mTriaging Real-time Security Threats with eBPF-powered Observability
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
34mTracing: The Bane of You Security Folks
23mSecuring Your Software Delivery Chain with Process Auditing