RSA recap, finding miners in kubernetes

For those who made it to RSA in San Francisco - and those of us who didn't - it's always fun to catch up after and talk about trends, products, or talks that we liked, or didn't. We'll have a panel of several people who attended RSAC, but will seek audience participation, as well.

After the panel, Alex Lawrence from Sysdig will be talking about his experience finding crypto miners in Kubernetes:

Kubernetes is designed to be highly-scalable and dynamic. With short-lived, ephemeral workloads running in Kubernetes clusters, it can be hard to detect which workloads are behaving as expected. Combine this with auto-scaling features on managed Kubernetes clusters, attackers can take advantage of distribution-grade resources to mine cryptocurrencies.

If Kubernetes was left in its default, insecure configuration, the DevOps teams managing the platform would likely be unaware of the breach, until they see their increased cloud bill. Kubernetes defines what is known as a “flat network”. All workloads can freely communicate with each other, and as a result there is no default setup to prevent outbound connections to mining pools or other known bad C2 servers. Kubernetes is the ideal platform for abusing compute resources while simultaneously connecting to the public internet.

In this talk, Alex will explain some of the intricacies of crypto-mining in Kubernetes and how crypto-jackers compromise containerized workloads at runtime. Using Open Source Falco, and its customizable plugin options, this session should help you think about your organization's current cluster configuration, where to identify Indicators of Compromise, and take corrective action to isolate workloads from adversaries.

Alex Lawrence is a Principal Security Architect at Sysdig. Alex has an extensive history working in the datacenter as well as with the world of DevOps. Prior to moving into a solutions role, Alex spent a majority of his time working in the world of OSS on identity, authentication, user management and security. Alex's educational background has nothing to do with his day-to-day career; however, if you'd like to have a spirited conversation on bioluminescence or fungus, he'd be happy to oblige.

Snacks will be sponsored by Sysdig!

Agenda:
5pm Doors open, networking
5:15 Panel: RSA Conference Recap
5:45 break
5:50 Alex Lawrence: Finding miners in Kubernetes
6:30 Finish