Real-Time Security: Using eBPF for Preventing Attacks

Explore how eBPF can be leveraged for next-generation security enforcement tooling in this 32-minute conference talk by Liz Rice from Isovalent. Dive into demos and code to understand why NetworkPolicy enforcement with eBPF has been established for years, while preventative security for applications has taken longer to develop. Learn about Phantom attacks and their potential to compromise basic system call hooks. Discover how other eBPF attachment points, such as BPF LSM, can be utilized for preventative security. Gain insights into Tetragon and its role in security observability. While prior knowledge of eBPF is not required, a basic understanding of kernel and user space concepts will be beneficial. Be prepared to examine some C code examples throughout the presentation.