Closing the Loop: Applying Least Privilege and Ensuring We Did It Well
summary
Kubernetes posture hardening: applies RBAC with generated roles and bindings, locks repo-driven config via Crossplane and project policies, and adds Falco kernel-level monitoring to correlate syscalls, container and audit logs. The uploader cites industry data: >90% of namespaces lack network policies and attackers hit test clusters within 22 minutes. A live test spawns a shell and Falco immediately alerts, proving detection works while reducing blast radius.
AI-written summary · about
chapters (9)
- 0:00Introduction to the talk
- 2:08Why least privilege matters
- 5:08Definition of least privilege
- 9:31Least privilege in Kubernetes
- 12:35Getting started with RBAC
- 16:09Trusting repositories over humans
- 20:28Blind spots and Falco
- 24:38Monitoring platform health
- 25:47Closing remarks
related talks
34mPrinciple of Least Privilege: How to Secure Kubernetes Without Making Users Hate You
22mSecuring Kubernetes
28mKubernetes Security Low-Hanging Fruit
35mKubernetes Security - Challenge and Opportunity?
41mKubernetes Security Jumpstart
50mRuntime Security for Containers
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
33mKubernetes Security Jumpstart