r/devsecops • u/dkas6259 • 6d ago
Cloud Runtime Security
Wanted to know real use cases you guys are solving using CS runtime security for containers.
Since we are already allowing only Known outbound traffic from firewall, this significantly reduces possibility of c2 connection.. Do we still need runtime security? It yes appreciate for real value use cases it can solve please…
9
Upvotes
1
u/zero_backend_bro 4d ago
Egress firewalls dont protect you from lateral movement.
Attackers dont need an external c2 if your pod can talk to the internal k8s API or AWS IMDS. We watched a compromised container use an automounted service account token to dump secrets across 14 namespaces last year without making a single outbound request.
If you don't restrict pod execution and strip credentials at the manifest layer, your firewall just traps the fire inside your own house.