OWASP 2025 Global AppSec EU

OWASP KubeFIM
Securing Kubernetes from the Inside Out: File Integrity Monitoring with eBPF

1. Introduction to Kubernetes Security & File Integrity Monitoring - The growing security challenges in Kubernetes.
- Why malicious containers inside clusters pose a huge risk.
- Real-world security incidents where attackers modified critical files (e.g., cryptojacking, rootkits).
- Why do traditional security tools fail in Kubernetes? (e.g., host-based FIM doesn’t work well).

2. What is OWASP KubeFIM & Why It Matters? - Overview of OWASP KubeFIM as an eBPF-based File Integrity Monitoring (FIM) solution.
- How eBPF helps detect file changes inside Kubernetes clusters without performance overhead.
- Use cases: Detecting malware, unauthorized file modifications, rootkit infections.

3. How OWASP KubeFIM WorksThe key components of KubeFIM:
- Kernel-level hooks
- Alerting system
- Policy-based file integrity monitoring

4. Setting Up KubeFIM in Your Cluster - Quick installation guide using Helm & Kubernetes YAML manifests.
- Configuring policies to monitor specific files (e.g., /bin, /etc, /var)
- Live demo of KubeFIM detecting unauthorized file changes.

5. Q&A + Discussion