Kubernetes Runtime Security
summary
Demo shows a default GKE deployment where a vulnerable Node web app accepts a GET parameter allowing command injection → reverse shell, then uses kubectl and gcloud to enumerate pods and project VMs; default GKE service account is able to create VMs and list instances. Remediations applied and proven effective: apply a deny-all Kubernetes network policy, tighten cloud IAM, and enable pod-level controls (AppArmor/SELinux/seccomp). Future options shown: container-aware monitors like Falco/sysdig and eBPF/Cilium for automated detection and mitigation.
AI-written summary · about
chapters (14)
- 0:00Start
- 4:14Security Overview
- 8:58Offensive Security
- 10:57Containers and Kubernetes
- 11:47Containerization
- 12:58Kubernetes
- 13:49Management Infrastructure
- 20:50Run Time Security
- 22:30Connect to a Default Configured Cluster
- 30:10Create More Vms
- 31:19General Advice
- 33:37Network Policies
- 34:09Network Policies for Kubernetes
- 41:17Kubernetes Aware Security Monitoring
related talks
35mKubernetes Security - Challenge and Opportunity?
37mKubernetes to Cloud Attack Vectors: Demos Inside
28mKubernetes Runtime Security: What Happens if a Container Goes Bad?
30mSecuring^WAttacking Kubernetes
38mKubernetes Security: Attacking and Defending K8s Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
26mHacking into Kubernetes Security for Beginners
33mSecuring Kubernetes in the Cloud