Security Kill Chain Stages in a 100k+ Daily Container Environment with Falco
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Wednesday, 2020-11-18· at 15:50· Intrado Virtual Event Platform,·
summary
MathWorks runs Falco with eBPF and custom rules across a cluster serving 100K+ MATLAB containers daily, and maps detections to the Lockheed Martin kill chain. Specific detections include API server audit events for unexpected pod→API calls, network rules flagging SSH port scans, a default unexpected package installation rule catching apt-get metasploit, symlink/file changes indicating breakout attempts, and alerts for deleted deployments. Rules are staged with the Falco Event Generator for automated system-call and Kubernetes action testing, and alerts include container IDs for correlation; a simple ML outlier (avg 1.6 → threshold 13.59 → 14 triggered) proves noisy-but-actionable detection.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:55Our Cluster Architecture
- 1:23Securing Our Cluster
- 1:59No System is Perfectly Secured
- 2:32Here Comes 2020
- 3:25How Do We Trace Back?
- 3:44Why Falco?
- 4:33Our Falco Strategy
- 5:14System Analysis
- 7:07Security Kill Chain with Falco
- 11:47Rule Example
- 17:02Falco Rules Testing (Demo)
- 23:06Our Approach To Use Falco
- 23:45Using Falco Alerts
- 24:43Security Observability
related talks
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
23mRuntime K8s Security: Threat Detection with Falcosidekick
54mResponding to security events on Kubernetes, let's build a Security..
29mDetecting cloud and container threats
36mIntro: Falco
25mUse Falco and eBPF to protect your applications
27mIntro: Falco
39mDeep Dive: Falco