Software Bill of Behavior SBOB

Imagine a software vendor distills all their knowledge of their own testing into a standard file and ships it with each update . Just like a Container Package-Insert (Packungsbeilage) 📦📃🩻

An SBOB is a profile that provides contrast between intended benign and malicious runtime behaviors.

It's understood to be an abstraction of linux kernel level behavior to express intent across systems:

• to explicitly test for false-negatives: each attack type can be verified as 'blind' or 'detectable'
• for continuous anomaly detection at runtime: allows end-users to calibrate their Detection/Reponse

🚨GOAL for 2027: 90 percent of all CNCF projects (that run on linux-k8s) get an SBOB

scale is hard in security and thats the main reason why a solid runtime expectation needs to be distributed from the entity that has the knowledge of the implementation details AND the test cases AND the tooling AND the requirements.

Trademark: Bill of Behavior is a registered trademark by Constanze Roedig, all rights reserved

Stay informed when more applications get SBOBs

Subscribe to the newsletter https://billofbehavior.com, follow us on Linkedin, or talk to us on slack

Format/Spec

Specification for the Kubescape reference implementation.

TLDR — run bobctl

Here for the vulnerable redis example:

curl -fsSL -o bobctl https://github.com/k8sstormcenter/bob/releases/download/v0.1.2/bobctl-linux-amd64
chmod +x bobctl && sudo mv bobctl /usr/local/bin/


make kubescape
make alertmanager


kubectl apply -f example/redis/sbobs/
kubectl apply -f example/redis/redis.yaml
kubectl apply -f example/redis/client.yaml


bobctl attack --attack-suite example/redis-attacks.yaml -n redis-demo --service redis --service-port 6379 --format table

kubectl logs -n honey -l app=node-agent -c node-agent

Try it out in a lab with a k3s and a k8s

Public again on Iximiuz Labs