Know Your Enemy: Mapping Security Risks Using Threat Matrix for Kubernetes
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 11:00· Room 408 AB + Online·
summary
Microsoft publishes an updated Threat Matrix for Kubernetes that maps concrete TTPs (examples: node-managed identity token theft, CoreDNS configmap poisoning, private registry image theft) and shows how to measure detection coverage using Kubernetes audit logs, image-whitelisting, service/ingress exposure monitoring and node process/cpu/memory checks. A real-world campaign against Kubeflow is analyzed (exposed dashboard → pipeline → legit TensorFlow image pulling a cryptominer from GitHub). Comparison with MITRE ATT&CK for Containers highlights differing inclusion criteria and technique placement. exposed sensitive interfaces
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:42Where did we start?
- 3:30Kubernetes threat landscape
- 4:33Threat Matrix for Kubernetes
- 5:35Examples
- 7:57Kubeflow Pipelines campaign
- 10:00Measuring the security coverage
- 14:17MITRE ATT&CK for Containers
- 14:53Which matrix should I use?
- 18:36Key takeaways
- 19:16Final words
- 20:35Useful links
related talks
37mThreat Modelling: How to Improve Your Kubernetes Security Posture with Threat Mod...
38mThreat Modelling Kubernetes: A Lightspeed Introduction
26mKubernetes Risk Assessment: Time to Go One Level Deeper
10mLightning Talk: Kubernetes Risk Assessment: Time to go one level deeper
22mSecuring Kubernetes
31mThreat Modeling for Kubernetes: Enhancing Security Posture in Complex and Regulat...
38mA Treasure Map of Hacking (and Defending) Kubernetes
33mAvengers Assemble: Threat Modeling Kubernetes Clusters at a...