Jonathan Lalou's Blog

Posts Tagged ‘RuntimeSecurity’

Lecturer

Andrew Krug leads Security Advocacy and Research at Datadog, directing initiatives that bridge observability and security through runtime context, threat research, and open-source tooling. His team publishes annual State of Cloud Security reports and maintains detection content for AWS environments.

Abstract

The session constructs a comprehensive monitoring framework that eliminates coverage gaps across generative AI, Kubernetes, and SaaS ecosystems. By combining cloud audit logs with runtime telemetry and behavioral enrichment, it enables precise threat detection while reducing alert fatigue through contextual prioritization.

Modern Cloud Attack Surface Expansion

Emerging technologies introduce new blind spots:

• Generative AI: Prompt injection, model theft via API
• Kubernetes: Container escape, privileged pod execution
• SaaS Platforms: Shadow IT, over-permissive API tokens

Traditional log-based detection misses runtime context—process lineage, file system activity, network connections—that reveals true intent.

Runtime Security Instrumentation Patterns

Datadog implements multi-layered telemetry:

collectors:
  - ebpf_process_tracking
  - container_runtime_socket
  - cloud_api_polling
  - dns_query_capture

eBPF programs capture system calls without kernel module deployment. Integration with AWS services provides:

• CloudTrail → API activity
• VPC Flow Logs → network relationships
• GuardDuty → threat intelligence

Contextual Detection Engineering

Rules incorporate runtime signals:

if process.name == "curl" and 
   parent.process.name == "sh" and
   network.destination.ip in known_c2:
    trigger_alert(severity="HIGH")

Behavioral baselining identifies anomalies—legitimate developers use curl; cryptominers spawn it from compromised containers.

OCSF Standardization Benefits

Adoption of Open Cybersecurity Schema Framework enables:

{
  "activity_id": 1,
  "category_name": "network",
  "class_name": "dns_activity"
}

• Vendor-agnostic rule authoring
• Simplified parser maintenance
• Portable detection content

Datadog contributes 200+ OCSF-normalized rules to the community.

Alert Prioritization and Noise Reduction

Runtime context transforms alerts:

Raw Event: S3 bucket made public
+ Runtime: No process accessed bucket in 90 days
= Low Priority (likely misconfiguration)

Raw Event: S3 bucket made public  
+ Runtime: Ransomware process enumerating objects
= Critical Priority (active compromise)

This approach reduces false positives by 70% while maintaining detection efficacy.

Integrated Response Workflows

Security teams operationalize through:

1. Triage: Unified dashboard with process trees
2. Containment: One-click instance isolation
3. Investigation: Session replay with system call tracing
4. Remediation: Automated patch deployment

Conclusion: Observability as Security Foundation

Runtime security complements rather than replaces logging strategies. The fusion of behavioral telemetry, standardized schemas, and cloud-native context creates a monitoring fabric that scales with innovation velocity. Organizations achieve comprehensive coverage without sacrificing signal quality.

Links:

• Lecture Video