https://retiari.us/tags/containers/ Recent content in containers on Alex Maestretti Hugo -- gohugo.io en-us Wed, 11 Oct 2017 12:59:25 +0000 https://retiari.us/posts/memory_forensics_cloud_containers/ Wed, 11 Oct 2017 12:59:25 +0000 https://retiari.us/posts/memory_forensics_cloud_containers/ At Netflix my targets are primarily Linux VMs running in a microservices environment. I rarely have to pursue criminal prosecution but often want to figure out what is happening. Much of the work in memory forensics has targeted Windows systems and forensically sound capture methodologies that pull the entire system memory. This focus makes sense given the attack surface that user systems represent; however, given my goals I believe that userland memory acquisition and targeted analysis of memory at process granularity could yield more efficient results. Microservices, CI/CD deployments of immutable and ephemeral instances, the trend to containers, and various hardening efforts in the kernel, confer advantages on the defender that we must leverage to keep up with the scale and velocity of our environment. Another area that is not well developed is when target processes on the edge manage their own memory, as many of today’s popular languages do. I am curious what folks are doing in this space, so I wanted to mention some trends I see and solicit feedback: Desktops vs Datacenters vs Microservices User systems are the most difficult to secure. Particularly general compute devices operated by a technical workforce that needs full access to their systems, and will install all manner of tooling from around the web to accomplish their jobs.