CloudNativeSecurityCon North America 2024

In the event of a security breach, employing well-defined DFIR techniques becomes imperative to mitigate the incident's impact effectively. However, with the spreading adoption of containers, the employment of DFIR processes and capabilities is becoming increasingly complex. Join us in an insightful session that will cover cutting-edge DFIR practices on container environments. After a short overview of the essence of DFIR, we'll direct our focus towards various advanced DFIR techniques within a Kubernetes environment, which can prove highly beneficial in the event of a compromise. Starting from how to checkpoint compromised apps and restore them in a sandboxed environment for further analysis, we will move to how to conduct memory forensics on container evidence using old-style open-source DFIR tools. At the end of the presentation, the audience will be familiar with the advantages and disadvantages of the latest DFIR capabilities and will have the basics to understand how to use them.