Lightning Talk: Securing K8s Pods from Within: A Runtime Approach
summary
Kubernetes pods expose any injected binary to the mounted service account token, letting an exploit perform lateral movement; the proposed fix is runtime enforcement that limits token and file access to a derived allowlist of processes. The talk shows use of LSM-based engines like KubeArmor and Security Profiles Operator that record behavior and auto-derive policies, highlights multi-cloud AppArmor/SELinux/BPF-LSM differences, and stresses a learning/drift mode plus event correlation to avoid breaking apps while tightening runtime least-privilege.
AI-written summary · about
chapters (6)
- 0:00Kubernetes threat landscape
- 2:03Workload security lifecycles
- 3:03The necessity of runtime
- 4:04Challenges of implementation
- 6:17Adopting zero trust models
- 7:31Tooling and future outlook
related talks
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
53mFlying Above the Clouds: Securing Kubernetes
24mRuntime Security: Challenges & Solution Space
43mKubernetes Security: Attacking and Defending Modern Infrastructure
01h 37mLines of Defence – Securing Your Kubernetes Clusters
28mKubernetes Security Low-Hanging Fruit
33mSecuring Kubernetes in the Cloud
30mSecuring^WAttacking Kubernetes