Identifying and Mitigating Cloud and Container Threats
Talkat ContainerCon @ OSS EU 2023 · on Wednesday, 2023-09-20· at 15:55· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Walks through concrete defenses: use minimal base images to drop surface area, image signing to avoid typo‑squat malicious images, and prioritize vulnerabilities by runtime usage (claims 87% of images have high/critical vulns but only ~2% are exploitable in practice). Shows a live Log4Shell exploit that spawns a reverse shell and installs a crypto miner; detection uses Falco + eBPF with Falco Sidekick to record system‑call events and push critical alerts, and the demo successfully surfaces the attacker steps.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:50Container threat landscape
- 7:52Securing container images
- 16:43Image signing and sources
- 19:51Runtime security importance
- 23:07Falco runtime detection
- 26:20Log4Shell demo and detection
- 36:21Key takeaways
- 38:09Zero trust and shift-left
- 39:36Q&A
related talks
41mIdentifying and Mitigating Cloud and Container Threats
39mInsecure Containers? Continuous Defense Against Open Source Exploits
21mMake threats visible in your cloud environment — Eric Jung
47mSecuring Containers By Breaking In
50mRuntime Security for Containers
50mContainer Attack Surface Reduction Beyond Name Space Isolation
30mMaster the Container Security Model with
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...