Course

Software Bill of Behavior - vendor supplied runtime profile for tampering and anomaly detection

Constanze Roedig
by  Constanze Roedig · on
SecurityKubernetes

We ♥️ supply chain security, thus was created SBOM - the Bill of Materials- but, we also need SBOB -the Bill of Behavior - This livelab proposes to standardize how to record a benign behavior profile, extract, sign and publish it, for users to consume, ingest, verify it and detect attacks and tampering. For software-vendors, a SBOB creates trust and transparency, For users, it makes anomaly detection realistically achievable.

#supplychain#anomaly#behaviour#oci#ebpf
Software Bill of Behavior - vendor supplied runtime profile for tampering and anomaly detection (cover image)

Reset Progress

Are you sure you want to reset your progress for this course? This action cannot be undone.

About This Course

We ❤ security, but what do you do when you cannot scan ?

For this, (zero-days, stolen or leaked credentials or agents gone off the rails) comes the Software Bill of Behavior, we lovingly call it BOB...

🚨Yes, this lab is finally back, completely reworked and with the latest Kubescape features in it. We'll add more examples and features as they become GA.

You can contribute to the bobctl repo under the Kubernetes Stormcenter or check out the progress of the initiative under billofbehavior.com

What's Inside?

About the Author

Constanze Roedig

Constanze Roedig

Find this author online

Writes about

SecurityKubernetesLinux

Frequently covers

#anomaly#behaviour#ebpf#eBPF#oci

How to Author Courses on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull course content

labctl content pull course bobshort-6301b2ea

This will create a local copy of the course content in a directory named bobshort-6301b2ea. You only need to do this once per course.

Stream your changes

labctl content push -fw course bobshort-6301b2ea

Run this command in a separate terminal to continuously upload your changes to the server while editing the course in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help