alcide

Alcide Blog

Cloud-native Security Provider

Securing Kubernetes Clusters Using Process Whitelisting

Apr 22, 2020 3:02:42 AM / by Natan Yellin posted in Runtime, process whitelist

0 Comments

Process whitelisting is a simple concept. In the K8s context, the basic idea is to create a list for each pod of all the processes that the pod is expected to run. Every time a process runs in your cluster you check if it is in the list. If an attacker manages to gain access to your cluster and starts running a malicious process then you can identify it immediately because a new non-whitelisted process is running. It doesn’t matter whether that process is a known bitcoin miner, a custom RAT (Remote Access Tool), or even a legitimate process like ssh. If the new process isn’t in the whitelist and isn’t part of the pod’s regular behaviour then it should be flagged immediately. 

Read More

Subscribe to Email Updates