Top Secret Cloud Native Security Lessons

on YouTube ↗58m

" summary

Kubernetes clusters routinely leak full control when defaults are loosened: public API servers and anonymous auth enabled let attackers create privileged containers that mount host disks or escalate to root, as happened with Tesla and cryptomining via a daemonset mounting /var/run/docker.sock. Practical defenses shown: run kube-bench/kube-score, enforce PodSecurityPolicy or Open Policy Agent rules, block egress with Istio or network policies, remove unnecessary Linux capabilities, and upgrade to patched Kubernetes to avoid issues like large-YAML OOM or CPU LVI exploits.

AI-written summary · about

" chapters (38)

1. 0:00Introduction
2. 0:30Our systems are constantly under attack
3. 1:48Hackers can steal AWS credentials
4. 2:27Top secret doesnt work
5. 3:46Premise
6. 4:00Bens background
7. 4:28Cutter Coder
8. 6:49QA
9. 7:16Kubernetes
10. 8:56Kubernetes Architecture
11. 11:32Kubernetes Loop
12. 12:29Applying Security
13. 18:11Rolebased access control
14. 19:40Rolebased security
15. 20:16API secrets
16. 20:57Pods
17. 22:09Privilege Escalation
18. 23:25Defaults
19. 23:55Privileged Containers
20. 27:10Kubernetes Page Limit
21. 28:15Remove Additional Capabilities
22. 29:46Lineage Capabilities
23. 31:26Allow Privilege Escalation
24. 33:03Installer Settings
25. 34:15System Anonymous
26. 37:38Security Permissions
27. 40:33Demon Sets
28. 44:48Network Policies
29. 46:38Be Secure by Default
30. 47:21Kubernetes Tools
31. 48:18Control Plane
32. 50:13Open Policy Agent
33. 51:09Mobility
34. 51:47AppArmor
35. 52:40CPU Bug
36. 53:58Upgrade Communities
37. 55:07What should we be doing
38. 56:32How to learn more

" related talks

• 53mFlying Above the Clouds: Securing KubernetesJack Mannino · OWASP AppSec USA 2018
• 43mKubernetes Security: Attacking and Defending Modern InfrastructureLenin Alevski Huerta Arias, Maximillian vonBlankenburg · RSA Conference 2024
• 33mKubernetes Security: Horror Stories to Help Secure Your ClusterPablo Fredrikson · KCD Guatemala 2023
• 22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native EraJasim Alam · KCD Dhaka 2024
• 35mInsights into Unsecured Kubernetes in the WildJay Chen, Aviv Sasson · KubeCon + CloudNativeCon North America 2021
• 32mHacking the Cloud Native Renaissance: Lowering Risk of Kubernetes AdoptionAndrew Martin · Open Source in Finance Forum London 2022
• 33mSecuring Kubernetes in the CloudAmiran Alavidze · BSides Vancouver 2021
• 35mKubernetes Security - Challenge and Opportunity?Marc Nimmerrichter · KCD Austria 2023