Securing Modern Financial Systems in the Age of AI - Rashid Feroze - ASW #406
Summary
This episode features a discussion with Rashid Farooz on using eBPF for runtime security in microservices and containers. They explore how eBPF sensors monitor syscalls to detect malicious behaviors like supply chain attacks and zero-day exploits, particularly in the context of recent PHP and Node.js vulnerabilities.
Topics discussed
Intro, sponsors, and guest introduction
Defining runtime security and architecture context
How eBPF works: kernel sandboxing and visibility
eBPF advantages: safety, debugging, and ease of use
Threat modeling: allow-lists and data exfiltration
Supply chain attacks and the speed of exploitation
eBPF in the kill chain: detection and prevention
Zero-day protection and vulnerability management
Unpacking malicious behavior visibility with eBPF
Case study: NPM supply chain attack mechanics
Baseline behavior, drift detection, and filter development
Existing tools and the maturity of eBPF ecosystem
Limitations: managed cloud services and shared responsibility
Comparing eBPF to hardware security enclaves (Nitro/TPM)
Prompt injection challenges and memory corruption flaws
Analyzing the PHP-to-Shell memory corruption bug
eBPF data limitations and signature-based detection
Managing data overload and using out-of-the-box rules
Deployment strategy: stakeholder buy-in and timing
Enforcement modes: blocking syscalls and false positives
Performance impact and developer benefits
Asset inventory and network observability outcomes
eBPF on endpoints vs. servers and EDR comparison
Limitations: logic-based attacks and impersonation
Current breach trends and negative patching timelines
Strategic outlook: is eBPF over-optimistic?
Practical advice: inventory, SBOMs, and impact analysis
Conclusion and final thoughts
Outro and subscription call to action
Listen ad-free on Castria