Kubernetes Security: Attacking and Defending Modern Infrastructure
summary
Shows how attackers move from leaked kubeconfig or cloud creds to running containers, stealing service‑account tokens, then escaping via writable hostPath or 280-character privileged pod command that grants host PID/network/filesystem access. Demonstrates common detections and mitigations: resource limits, network policies (Calico/Cilium), TLS and KMS encryption, audit logs, and enforcement with pod security admission / OPA Gatekeeper. Recommends scanning and hardening tools like kube-bench, cert-manager, Snyk/Deepfactor and GitOps for safer deployments.
AI-written summary · about
chapters (20)
- 0:00Kubernetes Security intro
- 1:04Containers and Kubernetes Fundamentals
- 3:32K8s architecture & components
- 7:04K8s threat model
- 7:26Common K8s attacks
- 11:44Execution phase in attacks
- 13:30Persistence methods
- 15:57Privilege escalation
- 18:32Defense evasion tactics
- 19:56Credential access
- 22:04Discovery & lateral movement
- 25:46Impact of compromises
- 26:51Container hardening
- 28:54Network policies
- 31:06Encryption in clusters
- 32:15Access control & pod security
- 35:46Audit logging & Kubelet
- 38:19Edge deployment challenges
- 38:43Ten security considerations
- 41:01Q&A
related talks
35mKubernetes Security - Challenge and Opportunity?
38mKubernetes Security: Attacking and Defending K8s Clusters
01h 37mLines of Defence – Securing Your Kubernetes Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
19mHacking Kubernetes
31mA Hacker's Guide to Kubernetes and the Cloud
22mSecuring Kubernetes