Kubernetes Risk Assessment: Time to Go One Level Deeper
summary
Argues that the CIS Benchmark is a solid, automatable baseline but insufficient alone, and that the MITRE ATT&CK for Containers adds more than 40 validated attack techniques (examples: malicious images used by TeamTNT for crypto mining, Kubeflow misconfigurations exploited on Azure, ingress-nginx exposing secrets). Recommends combining CIS posture checks, MITRE attack-context mapping, continuous automated assessment, and automated remediation so fixes reduce many downstream risks rather than listing isolated findings.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:00What are the risks
- 2:40The dynamic parts of Kubernetes
- 4:00Cisco Security Benchmark
- 5:43Security Misconfiguration
- 7:42Three Factors to Consider
- 10:52The MITRE Attack
- 12:28MITRE Metrics
- 13:50MITRE Methodology
- 14:17Attack Chain
- 17:58Benefits
- 18:26Challenges
- 19:57Ideal Work
- 22:30Ideal Framework
- 23:39Summary
related talks
10mLightning Talk: Kubernetes Risk Assessment: Time to go one level deeper
21mKnow Your Enemy: Mapping Security Risks Using Threat Matrix for Kubernetes
22mSecuring Kubernetes
19mHow to Secure Your Kubernetes Clusters
06mLightning Talk: Why you Should Really Pay Attention to K8S Security Best Practices - Benjy Portnoy
26mBoost your security and resiliency in Kubernetes
26mMulti-layer hardening in Kubernetes
36mThe Devil in the Details: Kubernetes’ First Security Assessment