Koney: Cyber Deception Policies for Kubernetes

Manually injecting a fleet of decoys into applications and detecting access attempts to them isn’t straightforward. Kubernetes, the dominant platform for modern software development, offers a great foundation into which we can easily integrate traps to detect hackers.

This talk will introduce Koney, a first-of-its-kind operator - that is, a "plugin for Kubernetes" - that allows you to define so-called deception policies for clusters. Koney automates the setup, rotation, and teardown of honeytokens and fake API endpoints, and uses eBPF to detect, log, and forward alerts when traps have been accessed.

This talk will present how application layer cyber deception techniques can be formalized "as code" and what technical methods can be used to inject traps at runtime, all without requiring access to source code. We will continue with a live demonstration of how Koney can place honeytokens in application containers in seconds.

Participants can leave with a better understanding on how cyber deception can be formalized in policy documents and be equipped with a functional open-source tool, Koney, that lets them experiment with cyber deception in their own environments.