Armoring Cloud Native Workloads With LSM | Barun Acharya @Detroit 2022

Containers are not protected by default as the various tools for security into place provides perimeter security at the host, or the network and not necessarily the workload itself. LSMs (Linux Security Modules) provide with security hooks necessary to set up least permissive perimeter for various workloads.

KubeArmor is a cloud-native runtime security enforcement system that leverages various LSMs to secure your workloads. LSMs are a really powerful system but they come with a high barrier of entry, steep learning curve and do not provide enough metadata for modern cloud native workloads.

This talk will be about how KubeArmor leverages LSM superpowers to abstract away the complexities to help protect modern cloud native workloads, how we leverage eBPF to provide context about what’s happening in the containers, how various kernel primitives fair with each to protect modern container workloads and what design considerations/challenges for integrating various LSM into KubeArmor.

⏳Timestamps
00:00:57 Runtime Threats
00:04:47 Runtime Enforcement
00:07:52 How to integrate LSMs with cloud native workload? 00:09:46 Problem Statement
00:10:10 What is KubeArmor?
00:11:40 Demo Scenario
00:20:41 Runtime protection results
——————————————————
💻 Learn more about AccuKnox
Website: https://www.accuknox.com/
Help Docs: https://help.accuknox.com/
Blogs: https://www.accuknox.com/blog
——————————————————
❓Get help with AccuKnox queries •
Email: [email protected]
Slack: https://kubearmor.slack.com/
Policy Templates: https://github.com/kubearmor/policy-templates
——————————————————
💬 Follow AccuKnox on social media
Twitter: https://twitter.com/accuknox
LinkedIn: https://www.linkedin.com/company/accuknox/
——————————————————
✅ Subscribe to Accuknox’s YouTube channel