Cloud Native Runtime Security with Falco - Kris Nova, Sysdig & Abhinav Srivastava, Frame.io

Falco is a CNCF Sandbox project focused on Container Runtime Security. In this maintainers track session the Falco maintainers will focus on what runtime security is and how it differs from other layers of security for Kubernetes. They will show how to enable system call abnormality detection using Falco’s eBPF integration, as well as how to detect abnormal behavior in the Kubernetes API server. Lastly, the Falco maintainers will walk through various implementation examples from end users of Falco, and how to integrate Falco in with cloud based event processing services to build security event pipelines. Attendees will leave with a better understanding of Falco and runtime security, how to get started writing their own Falco rules, and how to contribute improvements to the project.