- Gruppen-Buchungen / Inhouse ab 4 Personen
- Schulungsort: SBA Research oder bei Ihnen im Unternehmen
- Termine: individuelle Vereinbarung
- Vertraulicher Austausch innerhalb des Unternehmens
- Lösungsfindung für spezifische Problemstellungen
- Diskussion Unternehmensspezifischer Fragestellungen
This hands-on security course explores attacks in modern Linux systems, focusing on container environments such as Docker in cyber-physical systems (industrial, automotive). The participants learn about building blocks of containers, how attack container systems from the inside and outside, as well as defenses. The acquired skills can be applied in the following scenarios:
- Assess the security of containerized applications and software deployments
- Create defense guidelines for deployed applications and understand their weaknesses
- Find vulnerabilities in Linux-based containers and create exploits
- Identify supply chain vulnerabilities in container images
This training is a three-day training structured as follows:
Day 1: Linux and Containers
- Introduction into container security and first breakout
- Attacks via mounted filesystems and Volumes
- Container Runtime Interface (CRI) and Capabilities
- Image forensics (layers and metadata) SBOM
Day 2: Network and Runtime
- Container networks
- Lateral movement in container networks
- Container Network Interface (CNI) and Network Plugins
- Introduction into eBPF
- eBPF for Linux and container networking
Day 3: Devices and eBPF
- DAC/MAC (App-Armor) in containers
- Rootless containers
- Devices and device access (breakouts)
- eBPF for device control
- Ethernet, SPI, CAN
The following theoretical and practical background is covered by the workshop:
- Kernel internals: Namespaces, Control Groups v2, syscall interface, Application Binary Interface
- Virtual Networking: Container Network Interface (CNI), Network Namespace, Network Plugins
- Container Images: image meta data, forensic disassembly, Secrets in images
- Permissions and Capabilities; Discretionary Access Control (DAC) vs Mandatory Access (MAC)
State-of-the-art technology, such as eBPF is presented and how modern detection systems use the kernel to identify attackers in Linux and container systems.
Hinweis:The training takes place in a hosted environment.
Photo credit: ChatGPT.
