eBPF Superpowers for Enhanced Cloud Native Security

eBPF has emerged as a game-changer in the realm of cloud native security. Its efficient and flexible kernel-level instrumentation capabilities enable robust monitoring, threat detection, and policy enforcement in modern cloud native environments. In this session, we will take a deep dive into the security aspects of eBPF and explore how it empowers organizations to enhance runtime security and protect their applications. Introduction to eBPF: Definition and overview of eBPF and its significance in cloud native security. Understanding how eBPF provides a lightweight and versatile approach to secure the kernel. Observability and Threat Detection: Leveraging eBPF for dynamic tracing to gain real-time insights into application behavior and detect security anomalies. Exploring the role of eBPF in monitoring and profiling to identify potential vulnerabilities and threats. Network Security with eBPF: Utilizing eBPF for advanced network security measures, including network monitoring, intrusion detection, and packet filtering. Demonstrating how eBPF enhances network security in cloud native environments and protects against malicious activities. Runtime Security: Uncovering the runtime security applications of eBPF, such as intrusion detection, policy enforcement, and anomaly detection. Showcasing how eBPF enables proactive security measures by monitoring and securing application execution at the kernel level. Real-World Use Cases: Examining practical examples of how eBPF is deployed in open source cloud native security tools. Reviewing architectural patterns that solve the most common workload security use cases in kubernetes This presentation aims to provide attendees with a comprehensive understanding of how eBPF can significantly enhance security in cloud native environments. By exploring the various security-focused applications of eBPF, participants will gain valuable insights into leveraging eBPF's superpowers to fortify their runtime security posture and safeguard their cloud native applications.
SANS CloudSecNext Summit 2023
eBPF Superpowers for Enhanced Cloud Native Security
Speaker: Daniel Chan, Solutions Architect, Isovalent
View upcoming Summits: www.sans.org/u/DuS