Getting Started with Container Runtime Security Using Falco

Explore container runtime security using Falco in this 56-minute CNCF webinar. Gain insights into cloud native security, focusing on runtime aspects, and discover the inspiration behind Falco, the CNCF container security project. Learn about Falco's real-world applications, adoption, and future developments through demonstrations and discussions. Delve into topics such as CICD journey, kernel-based instrumentation, metadata collection, Falco architecture, rule creation, and its comparison with other tools. Understand Falco's history, features, and roadmap while addressing common questions about errors, compliance, and notifications.

Introduction
Welcome
About Sysdig
Agenda
What is runtime security
CICD journey
Where runtime security starts
What is LD Preload
Limitations of LD Preload
Ptrace
Kernelbased instrumentation
Kernelbased instrumentation advantages
Metadata collection
Falco
Falco Community
Shopify
SkyScanner
Falco Architecture
Sources of Data
Whats a rule
Example
Rules
Demo
Falco history
Falco features
Falco roadmap
Questions
Falco error
Falco vs istio
Falco compliance
Falco notifications