Investigating Security Incidents with Forensic Snapshots in Kubernetes
UB4.132 | Day 2 | 11:15 - 11:45 | Speakers: Adrian Reber, Radostin Stoyanov, Lorena Goldoni
Abstract
The absence of forensics data can be just as dangerous as the presence of malicious activity. While traditional digital forensics focuses on artefacts located on storage devices, containerized environments like Kubernetes introduce new challenges for collection of digital evidence from compromised applications, where malware now routinely leaves no traces. In this talk, we are going to explore how to collect, preserve, and analyse forensic snapshots with transparent checkpointing methods while maintaining a chain of custody to investigate security incidents. We will also discuss techniques for automation in real-world scenarios and best practices for capturing and analysing malicious activity in compromised containers.
Speakers
Adrian is a Senior Principal Software Engineer at Red Hat and is migrating processes at least since 2010. He started to migrate processes in a high performance computing environment and at some point he migrated so many processes that he got a PhD for that. Most of the time he is now migrating containers but occasionally he still migrates single processes. Currently he serves as the OpenHPC project lead.
Radostin is a PhD student in the Scientific Computing research group at the University of Oxford. His research focuses on improving resilience and optimizing resource utilization of high-performance computing (HPC) and cloud computing systems. Before joining Oxford, he completed an MPhil in Advanced Computer Science at the University of Cambridge and an MEng in Computing Science at the University of Aberdeen. His master's research explored virtualization in programmable network devices and secure image-less container migration.
Lorena Goldoni is a Threat Detection Engineer at Certego, designing and implementing detection logic based on network traffic and telemetry data. Her work focuses on login detection and behavioral analysis through correlations across multiple log sources, aimed at identifying malicious activity in complex environments.
Her interest in detection engineering originated during her Bachelor’s degree in Security of Computer Systems and Networks in Milan, where she developed BuffaLogs at Certego, a project centered on log correlation for login detection. She is currently completing her Master’s degree in Modena, where her academic focus has expanded toward cloud technologies and machine learning, bridging foundational detection engineering with modern, scalable security approaches.
Links
External Links
Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.