Imagine a software vendor distills all their knowledge of their own testing into a standard file and ships it with each update . Just like a Container Package-Insert (Packungsbeilage) 📦📃🩻
An SBOB is a profile that provides contrast between intended benign and malicious runtime behaviors.
It's understood to be an abstraction of linux kernel level behavior to express intent across systems:
- to explicitly test for false-negatives: each attack type can be verified as 'blind' or 'detectable'
- for continuous anomaly detection at runtime: allows end-users to calibrate their Detection/Reponse
🚨GOAL for 2027: 90 percent of all CNCF projects (that run on linux-k8s) get an SBOB
scale is hard in security and thats the main reason why a solid runtime expectation needs to be distributed from the entity that has the knowledge of the implementation details AND the test cases AND the tooling AND the requirements.
Trademark: Bill of Behavior is a registered trademark by Constanze Roedig, all rights reserved
Subscribe to the newsletter https://billofbehavior.com, follow us on Linkedin, or talk to us on slack
Next up release: Argo CD with all of its seven components:
Specification for the Kubescape reference implementation.
Here for the vulnerable redis example:
curl -fsSL -o bobctl https://github.com/k8sstormcenter/bob/releases/download/v0.1.2/bobctl-linux-amd64
chmod +x bobctl && sudo mv bobctl /usr/local/bin/
make kubescape
make alertmanager
kubectl apply -f example/redis/sbobs/
kubectl apply -f example/redis/redis.yaml
kubectl apply -f example/redis/client.yaml
bobctl attack --attack-suite example/redis-attacks.yaml -n redis-demo --service redis --service-port 6379 --format table
kubectl logs -n honey -l app=node-agent -c node-agentBecause it was turned into a private repo for a few hours ... well gotta adversarially test the AI dont we.
In the first week of August, we are testing the whole setup. Then you ll see it.