Security Observability with eBPF

Table of contents

1. 1. The Lack of Visibility
   1. What Should We Monitor?
   2. High-Fidelity Observability
   3. A Kubernetes Attack
   4. What Is eBPF?
   5. Brief Guide to Container Security
      1. Kernel Namespaces
      2. Cgroups
      3. Attack Points for Container Escapes
      4. Linux Capabilities
2. 2. Why Is eBPF the Optimal Tool for Security?
   1. Precloud Security
   2. Monitoring from Legacy Kernel, Disk, and Network Tools
   3. A Cloud Native Approach
   4. Deep Dive into the Security of eBPF
      1. Virtual Machine in the Kernel
      2. eBPF Programs
      3. eBPF Hook Points
   5. Why eBPF?
      1. System Call Visibility
      2. Network Visibility
      3. Filesystem Visibility
   6. The Underlying Host
   7. Real-World Detection
3. 3. Security Observability
   1. The Four Golden Signals of Security Observability
   2. Process Execution
   3. Network Sockets
   4. File Access
   5. Layer 7 Network Identity
   6. Real-World Attack
      1. Stealthy Container Escape
      2. Install Cilium Tetragon
      3. Reaching The Host Namespace
      4. Persistence
      5. Post Exploitation Techniques
4. 4. Security Prevention
   1. Prevention by Way of Least-Privilege
      1. Allowlist
      2. Denylist
      3. Testing Your Policy
      4. Tracing Policy
      5. Stage 1: Exploitation
      6. Stage 2: Persistence and Defense Evasion
      7. Stage 3: Post-Exploitation
      8. Data-Driven Security
   2. CTFs, Red Teams, Pentesting, Oh My!
5. Conclusion
6. About the Authors