Preventing Attacks at Scale
summary
Shows how to detect container breaches end-to-end: process execution and outbound connections are captured at the kernel via Linux tracing rather than slow audit, sent to AWS Kinesis/Firehose, processed by Lambda, stored in Elasticsearch/Kibana and alerted via SQS for automated response (example: shellshock exploit -> remote shell -> cluster persistence via kube API or Helm). Demonstrates a single-binary Capsule8 sensor, advocates eBPF/kprobes over audit for performance, and explains automatic remediation like kubectl delete from a Lambda.
AI-written summary · about
chapters (28)
- 0:00Intro
- 1:55The cyber security skills shortage
- 5:25Security pipeline models
- 8:42Prevention vs response
- 12:28Server Breaches
- 14:40Data Breaches
- 16:27ShellShock
- 17:38Yolo
- 21:59Escalation
- 25:08Continuous Security Pipeline
- 26:33Building the Pipeline
- 27:54Testbed Setup
- 28:54Firehose
- 29:53Event Sources
- 31:15Dive Deeper
- 32:22Sensor
- 32:51Manual Search
- 33:11Lambda
- 33:41Training
- 37:02Container Linux
- 38:37BPF
- 42:03Audit Log
- 42:46Signal stopping
- 44:31Workload separation
- 45:30Delegated authentication
- 46:22Vaults
- 49:31Event Stream
- 53:38Health Monitoring
related talks
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
19mHacking Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
19mSecurity foundations for containers
46mAttacking AWS: The Full Cyber Kill Chain
30mEffective Detection in Kubernetes Clusters
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals