Security Observability with eBPF

Chapter 4. Security Prevention

What if you want to prevent an attack instead of retroactively detecting it? In this chapter, we’ll use the security observability events that we detected in Chapter 3 to develop prevention policies to block the attack at different stages. Using security observability events to develop a prevention policy is called observability-driven policy. We directly translate the security observability events to craft prevention policy based on observed real-world behavior. Why do we suggest using real events to create such a policy?

Security prevention is a powerful tool; it has the ability to stop attacks before they occur. However, used incorrectly, it also has the ability to break legitimate application or system behavior. For example, if we wanted to create a prevention policy that blocks the setuid system call,¹ we could break legitimate container runtime initialization behavior that requires the setuid system call.

So, how can you create a prevention policy that denies malicious behavior but doesn’t negatively impact your applications? Referencing your security observability events, you can quickly identify all of the setuid system calls made in your environment. Identifying runtime or application events that include the setuid system call prevents you from applying a breaking change to your policy.

Security observability can also highlight misconfigurations or overly permissive privileges in your workloads. This gives security the data it needs to ...