eBPF for Creating Least Privileged Policies; What Do I Need to Know to Prepare for the Next CVEs?
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 10:40· Salt Palace | Level 1 | Grand Ballroom B·
summary
Claim: eBPF moves policy enforcement into the kernel so enforcement survives agent downtime and avoids terabytes of userland telemetry. Implementation uses Tetragon to hook arbitrary kernel functions and filter syscalls/files/network and stores models in BPF maps. Demo runs on 10-node AWS cluster with 20 microservices (OpenTelemetry demo), uses Vector and Splunk for optional export, generates baseline policies, applies them, and surfaces violations. At scale the team measures data growth (example: ~1 TB/day at 100 nodes) as the problem being solved.
AI-written summary · about
chapters (11)
- 0:00eBPF for least privilege
- 1:02Securing cloud-native apps
- 2:30Least privilege in Kubernetes
- 5:22eBPF bridges kernel and Kubernetes
- 7:29eBPF and Tetragon policies
- 9:36Scaling policies across nodes
- 11:43Security models in Linux kernel
- 14:08Demo setup
- 14:32Runtime security events
- 15:12Splunk data analysis
- 15:56Baseline policies and violations
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
36meBPF for Runtime Security
20mClosing Perspectives
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
14mWill eBPF Save Us From the Next Global Outage?
32mReal Time Security - eBPF for Preventing attacks
42mResolving Performance and Security Issues with eBPF
32meBPF: The Next Power Tool of SREs