Page History

...

1. File Integrity Monitoring: Any changes to the systems folders should be monitored/audited.
2. Reverse Shell execution
3. Use of security sensitive primitives: setuid(), setguid(),chmod(),chown(),
4. Updates to root certificates folder
5. Use of kubectl exec  to gain shell access in the pod
6. Privilege escalation attempted
7. Monitor for external networks access
8. Suspicious IP detection (for e.g. using Feodo Blocked IP List)
9. Monitor for use of DGA (Domain Generation Algorithms) in the workload

Application Performance Monitoring:

...

1. Network Segmentation and enforcing least privilege nnetwork access
2. Enforce Process Whitelisting
3. Enforce least permissive access to sensitive assets. All volume mount points can be considered sensitive assets.
4. Enforce least permissive process based network control. Only allow certain set of processes to do network communication.

Protection: Enforcing Network Protection

TODO

Workload Forensics

...

1. Enforce Ingress/Egress controls using CIDRSets, Domain names, Protocols/Ports
2. Auto Discover Network Protection rules.

Workload Forensics

1. Workload Process Monitoring
2. Workload Sensitive Asset access
3. External Network exposure for workloads
4. Ability to query forensics details for a specified time duration from past X days.

charisse lu Should we create security guidelines for workload creators?

...