Re:How to catch a cryptominer on your Kubernetes infra
by webb on Tuesday November 12, 2019 @12:00AM
(#21511652)
I agree that appropriate configuration/policy management is part of the solution for preventing these attacks on Kubernetes, but our view is that monitoring also plays an important role.
[ Parent
| on HN ]
Re:How to catch a cryptominer on your Kubernetes infra
by cyphar on Tuesday November 12, 2019 @12:16AM
(#21511715)
I should've said "limited in usefulness for detecting moderately-clever attackers" rather than just flat-out "useless". Monitoring is obviously a useful tool regardless of whether it will always help you detect attackers in your network. You could use nf_conntrack on the host as well but that could also be bypassed by a root process on the host.