Course · Training · Workshop
Container & Kubernetes Defense feat. eBPF
Three days bootcamp on defending kubernetes at the professional level. Understand how to systematically cut through the noise and never play catch up again
Security of Containers and Kubernetes based systems can easily get out of hand. eBPF is a technology that allows us to quasi X-ray our entire infrastructure and applications. This course will show you how to drastically simplify your security maintainence by combining observability, network, performance and security eBPF tools. So that neither attackers nor vendors can hide from you.
Trainers
What participants say
The training was extremely exciting! Thanks to the variable course program, we were able to set our priorities according to our wishes and interests, which made the whole thing even more interesting. The level of the course really appealed to me and I can now combine the eBPF world, which is new to me, with my well-known area “Kubernetes” in a useful way! After the course, I am also not lacking any new inspiration and topics that I would like to dedicate myself to.
MattiaPlatform Engineer Kubernetes I Kanton Aargau
These customers booked courses in the same topic cluster.More customers →
Content
The main objective of this course is to empower you to find what matters fast. From understanding the basic 8 attack classes to fighting alert-fatigue with anomalies and automating as much as possible. My goal is to give you tools and techniques to become Cyber-Resilient on Kubernetes.
What to look for:
- Container Primitives DeepDive: security starts here
- Break Down the Attack Classes of containerized systems on Linux:
- Container Escapes
- Insecure Volumes and Mounts
- Abuse of Capabilities
- Pivots over Sockets
- Roles and Identities (RBAC) abuse
- Token Impersonation
- Misc
- Different approaches to effective threat modelling (mini Workshop)
How to find it:
- Zero Days and the power of anomaly detection (Inspector Gadget)
- Making Network policies secure-by-default
- How to keep all your rules uptodate (Bill of Behavior)
- EU CRA: I have 24 hrs to detect a Breach -> how to achieve this?
- Making threats observable with CNCF Pixie and Kubescape:
- Find vulnerable libraries
- How to inspect the memory (using CRIU)
- How to introspect SSL traffic
- How to identify data exfiltration
How to fix it:
-
Building Container Images: how to measure true quality
-
Dos and Donts in CI-CD Design
-
Forensic Storage vs PII compliance: what to avoid
-
Audit yourself: continuous hardening via automation
- Block vulnerable code from executing
-
Control Loop Decoupling and Breach Containment (Theory)
-
Making Network policies secure-by-default
-
How to keep all your rules uptodate (Bill of Behavior)
-
Optional: Identity federation, Linux Security Modules, “CVE of the day”
-
Optional: Discretionary Access Control
The concepts you will learn apply across most container based system running on Linux and are cloud agnostic. Some highlighted CVEs may affect only certain providers. Kernel knowledge is NOT required, solid Linux knowledge is required.
The entire course is hosted in live hands-on labs: get a taste right now https://labs.iximiuz.com/courses/discoverebpf-0d7c6c54
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about Kubernetes Defense and eBPF
Having a distributed system of ever moving parts and pieces can be daunting to defend. The Cloud Native Compute Foundation (CNCF) ecosystem has evolved several mature projects that we leverage to achieve both human and machine friendly comprehensive security posture. This course focuses on runtime defense as this is where the breaches occur. This includes the runtime of development and build environments. However we will also cover how supply chain security plays a crucial role and how achievable certain Best Practises really are for end users.Further resources:
History
eBPF (extended Berkeley Packet Filter) has its roots in the classic Berkeley Packet Filter (BPF), which was created in the early 1990s to efficiently filter network packets. The modern eBPF was a significant redesign led by Alexei Starovoitov and was merged into the Linux kernel in 2014.
The "extended" part is key: eBPF evolved from a simple packet filter into a general-purpose, event-driven virtual machine inside the Linux kernel. It allows sandboxed programs to be attached to various kernel hooks (syscalls, network events, tracepoints) to safely and efficiently extend kernel capabilities without changing kernel source code or loading kernel modules.
This programmability has made eBPF the foundation for a new generation of high-performance networking, observability, and security tools in the cloud-native ecosystem, including projects like Cilium, Falco, Pixie and Kubescape. It is now governed by the eBPF Foundation under the Linux Foundation.