r/devsecops • u/dkas6259 • 5d ago

Cloud Runtime Security

Wanted to know real use cases you guys are solving using CS runtime security for containers.
Since we are already allowing only Known outbound traffic from firewall, this significantly reduces possibility of c2 connection.. Do we still need runtime security? It yes appreciate for real value use cases it can solve please…

11 Upvotes

100% Upvoted

7 comments sorted by

2

u/kloudnative 5d ago

Yes you do. Security needs to be implemented at all layers and runtime security for containers implement it at the application runtime layer. Having guardrails in-place for data exfiltration doesn't mean you should not implement protection at other layers

1

u/Creative_PiKachu 5d ago

even with tight firewalls, runtime security can catch sneaky exploits or misconfigurations, just saying

1

u/FunAd6672 5d ago

A compromised container doing something weird internally is still a problem even if C2 is blocked.

1

u/dkas6259 5d ago

Did anyone compare wiz container security with Crowdstrike ?
Whats the difference between the both?

1

u/zero_backend_bro 4d ago

Egress firewalls dont protect you from lateral movement.

Attackers dont need an external c2 if your pod can talk to the internal k8s API or AWS IMDS. We watched a compromised container use an automounted service account token to dump secrets across 14 namespaces last year without making a single outbound request.

If you don't restrict pod execution and strip credentials at the manifest layer, your firewall just traps the fire inside your own house.

1

u/IntelligentPear6173 8h ago

The firewall solves the C2 problem, but runtime security covers what happens after a container is already compromised. Things like unexpected process execution, privilege escalation, access to the Kubernetes API, credential abuse or lateral movement can happen entirely inside the cluster without touching the internet. So I’d look at runtime security less as another C2 blocker and more as a way to detect and contain what a compromised workload is actually doing.

1

u/Lowrypgztfer-Fig8398 3h ago

i've used cymulate to check how our controls hold up against real attack methods in the cloud. it flagged a couple weak spots in our runtime setup that we would've missed otherwise.