Open Source Security Tools for Kubernetes Applications - Michael Ducy

### Overview Michael Ducy from Sysdig presents an architectural and practical overview of open-source security tools for Kubernetes and containerized applications. The talk examines container security through multiple layers, emphasizing the build pipeline and runtime environments. Ducy frames modern container security challenges around the concept of shifting choice to the left, ephemeral container lifecycles, and shared-kernel resource isolation, while demonstrating how open-source tools can enforce policy and automate threat response.

### Key Topics - **Layers of Container Security**: Security spans underlying infrastructure (host, network, cluster, container runtime), the build phase (source code, dependencies, artifacts), and the runtime phase (secrets, admission, anomaly detection, forensics). - **Shift Left vs. Choice**: Shifting left should empower development teams with informed choices while establishing automated guardrails such as image analysis and admission controllers. - **Infrastructure Hardening**: Utilizing core Kubernetes constructs including RBAC, pod security policies, affinity rules, seccomp, SELinux, AppArmor, resource constraints, and network policies. - **Image Scanning & Build Security**: Employing Anchore Engine within CI/CD pipelines to scan container images, inspect OS/third-party dependencies, and block vulnerable or misconfigured images. - **Runtime Security & Threat Detection**: Monitoring system calls and orchestrator metadata via Falco to identify abnormal behavior such as spawned shells, binary modifications, and crypto-mining activity. - **Automated Response Engine**: Leveraging event streams, pub/sub messaging (NATS), and serverless functions (Kubeless) to autonomously remediate threats in real time.

### Technical Details - **Infrastructure Verification**: Tools like kube-hunter pen-test clusters for exposed endpoints (such as dashboard or kubelet API vulnerabilities), kube-bench audits against CIS benchmarks, and kubesec analyzes deployment YAML manifests against best practices. - **Network & Service Controls**: Cilium enables Layer 7 network filtering. Spiffe/Spire and service meshes address service identity and admittance, while HashiCorp Vault manages secrets delivery. - **Anchore Engine**: Analyzes container native artifacts, evaluating OS packages, NPM/gem/Java dependencies, Dockerfile configurations, and hardcoded secrets. It integrates into Jenkins and works with Kubernetes admission controllers (including mutating controllers) to enforce image deployment rules. - **Falco Architecture**: Falco utilizes a kernel module to capture low-level system call streams, which are filtered using Sysdig libraries and evaluated against rule files containing macros and lists. Out of the box, Falco provides 25 core rules detecting conditions such as writes to `/bin` or `/etc`, shell execution, namespace manipulation, or unexpected outbound connections. - **Playbooks & SIEM Integration**: In an event-driven setup, Falco alerts publish to NATS topics categorized by severity. Kubeless serverless functions consume these alerts to execute remediation actions, such as killing an offending pod, tainting a worker node, or isolating a pod via network policy. Furthermore, events can be aggregated into an EFK stack (Elasticsearch, Fluentd, Kibana) for dashboarding and forensic review.

### Takeaways Securing Kubernetes requires automated defense in depth across the build and runtime stages. By validating artifacts early with tools like Anchore and monitoring system calls continuously at runtime using Falco, security teams can establish baseline behavior and trigger automated, granular remediation using lightweight functions without disrupting cluster operations.