Keynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 09:22· Exhibit Hall AB - San Diego Convention Center, Ground Level·
summary
Attackers treat a cluster as a graph and commonly enumerate permissions with kubectl auth can-i, map relationships with Octant, and probe admission controllers; features like ephemeral containers and mutating admission webhooks create escalation or persistence opportunities. Cloud metadata exposure and overly permissive service accounts regularly yield lateral movement. Kubernetes is not secure by default; concrete defenses are threat modeling (use STRIDE), least privilege, admission control, reducing attack surface, and practicing attacker-style exercises like CTFs to validate assumptions.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:54HI COMMUNITY!
- 3:01WHO DO YOU DESIGN FOR?
- 3:37ATTACKERS HAVE USER STORIES TOO
- 3:47WHO ARE ATTACKERS?
- 4:51HOW DO ATTACKERS THINK?
- 7:04WHAT DO ATTACKERS LOOK FOR?
- 8:27ATTACKER METHODOLOGY
- 9:41DESIGNING FOR DEFENSE
- 12:56CHECK YOUR ASSUMPTIONS
- 14:22THINGS YOU CAN DO
- 15:30MAKE FRIENDS!
- 17:56BETTER TOGETHER
related talks
43mKubernetes Security: Attacking and Defending Modern Infrastructure
31mA Hacker's Guide to Kubernetes and the Cloud
35mKubernetes Security - Challenge and Opportunity?
01h 37mLines of Defence – Securing Your Kubernetes Clusters
19mHacking Kubernetes
29mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
06mKeynote: Future-Proofing Kubernetes