Runtime Security
Runtime security is the discipline of detecting and responding to threats while workloads are executing — as opposed to scanning artifacts before deployment (shift-left) or enforcing policy at admission time. It assumes prevention eventually fails and asks: how do we catch the attacker who is already inside? Source: Falco for Kubernetes Security — CKS Scenarios
Where Runtime Security Sits in the Defense Timeline
| Phase | Question Answered | Canonical Controls |
|---|---|---|
| Build (shift-left) | Is this artifact safe to ship? | SCA, image scanning with Trivy |
| Deploy (admission) | Is this manifest allowed to run? | Kyverno / OPA Gatekeeper, Pod Security Standards |
| Runtime (detect) | Is this running workload behaving badly right now? | Falco, audit logging, SIEM correlation |
Each phase compensates for the limits of the previous one: a vulnerability-free image can still be misused, and a policy-compliant Pod can still be hijacked. Runtime security is the final safety net in the defense-in-depth stack — the Detect/Operate layer of DevSecOps and the rightmost complement of Shift Left Security.
The Observation Problem
Detection requires a signal an attacker cannot forge or evade. Application logs are tamperable and sidecars see only what the app emits; the reliable vantage point is the kernel boundary — every meaningful action (open a file, spawn a shell, connect a socket) must cross it as a system call. This is why Falco, the de facto standard for Kubernetes runtime security, hooks syscalls with an eBPF probe (or legacy kernel module) and evaluates them against declarative rules in its user-space engine.
What Runtime Detection Looks Like
Representative runtime detections, all expressible as Falco rules:
- A container spawning an unexpected interactive shell (
bash,sh) — classic post-exploitation behavior - A workload reading sensitive host files such as
/dev/memor shadow password files - A Pod opening an outbound connection to a rare or known-bad IP
- A privileged container appearing in a production namespace
- Unexpected writes below binary or config directories
An alert is only useful if it identifies the culprit: outputs interpolate fields like %proc.cmdline, %container.id, and %k8s.pod.name, and on host installs the container ID is mapped to a Pod with crictl ps. See CKS Certification for the full hunt loop — rule → alert → Pod → remediation (kubectl delete deploy) — as it appears in exam scenarios.
Alert Fan-Out
Runtime alerts must reach humans and systems to be acted on. Falco emits to stdout, syslog, gRPC, and Prometheus; Falcosidekick forwards over HTTP to Slack, S3, Loki, and dozens of other sinks — plugging runtime detection into the same logging and monitoring fabric as the rest of cluster telemetry.
See Also
- Falco — the runtime security engine detailed
- CKS Certification — where runtime-security scenarios are tested
- Container Security — runtime detection in the defense-in-depth stack
- Shift Left Security — the build-time complement
- Kyverno — the admission-time preventive complement
- DevSecOps Fundamentals — the Operate stage
- SAST, DAST, and SCA — pre-runtime testing disciplines
- Kubernetes Logging and Monitoring — the telemetry fabric alerts join
- Falco for Kubernetes Security — CKS Scenarios — the source video
Tags: security runtime-security kubernetes falco devsecops detection