CKS — Runtime Security & Falco

Chapter 10 — Runtime Security & Falco

This chapter covers Domain 6 — Monitoring, Logging & Runtime Security, which carries 20% of the CKS exam weight. This is one of the highest-weighted domains on the exam, and Falco is the primary tool you will be tested on.

Runtime security is the last line of defense. Admission controllers, network policies, and RBAC prevent misconfigurations before workloads run. Runtime security detects threats after a workload is already executing — when an attacker has bypassed all other controls and is actively inside your cluster.

Why This Domain Matters

Aspect	Detail
Exam Weight	20% — one of the heaviest domains
Primary Tool	Falco (CNCF graduated project)
Key Skills	Install Falco, write/modify rules, detect threats, enforce immutability
Attack Surface	Container runtime, syscalls, process execution, file access
Defense Philosophy	Detect what prevention missed

What You Will Learn

#	Topic	Link	Focus
1	Falco Setup & Installation	Falco Setup	Install Falco, configure drivers, verify operation
2	Falco Rules	Falco Rules	Rule syntax, macros, lists, custom rules, overrides
3	Syscall Monitoring	Syscall Monitoring	Kernel module, eBPF, syscall-to-threat mapping, sysdig
4	Immutable Containers	Immutable Containers	readOnlyRootFilesystem, drop capabilities, full lockdown
5	Threat Detection	Threat Detection	MITRE ATT&CK phases, Falco detection rules, incident response
6	Hands-On Lab	Runtime Security Lab	End-to-end exercises with Falco and immutable containers

The Runtime Security Stack

┌─────────────────────────────────────────────────────────┐
│                    Alert Destinations                     │
│           (Slack, PagerDuty, Falcosidekick)              │
└──────────────────────┬──────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────┐
│                   Falco User-Space Engine                │
│         Rules Engine → Condition Matching → Output        │
│    /etc/falco/falco_rules.yaml + falco_rules.local.yaml  │
└──────────────────────┬──────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────┐
│              Falco Driver (Kernel Module / eBPF)         │
│              Intercepts syscalls from containers          │
└──────────────────────┬──────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────┐
│                    Linux Kernel                           │
│         open, read, write, execve, connect, clone        │
└─────────────────────────────────────────────────────────┘

Exam Strategy

1. Know how to install Falco from a DEB package — the exam may provide a node where you must install and configure it.
2. Master rule syntax — you will likely need to create or modify a Falco rule to detect a specific behavior.
3. Understand immutable containers — expect to configure a Pod with readOnlyRootFilesystem, dropped capabilities, and runAsNonRoot.
4. Read Falco logs — use journalctl -u falco to find alerts matching specific criteria.
5. Time management — Falco tasks can be quick if you know the config file locations and rule syntax.

Key File Locations (Memorize These)

File	Purpose
/etc/falco/falco.yaml	Main Falco configuration
/etc/falco/falco_rules.yaml	Default rules (do NOT edit)
/etc/falco/falco_rules.local.yaml	Custom rules and overrides
/var/log/syslog or journalctl -u falco	Falco alert output

---

Next: Falco Setup & Installation →