How to Train your Red Team (for Cloud Native)
summary
Describes a practical method: build threat models, encode exploits as attack trees, map concrete controls to prune branches, then validate by running automated red-team exercises against production-like clones. Demonstrates an open-source Kubernetes CTF called cubesim with 25 scenarios that provisions clusters, scores attempts, and enforces billing and isolation limits. Targets cloud-native misconfigurations common in finance (service account tokens, poisoned images, privileged pods) and reports that the simulator is usable for repeatable training and control regression testing.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:34Who's using Kubernetes?
- 7:04Managing Risk with Security Functionality
- 7:25Security Team Sees Kubernetes
- 8:02The skills problem
- 9:58Using Threat Modeling to secure a Cluster
- 11:30What is Threat Modelling?
- 14:35Representing a Threat Model
- 16:02Kubernetes Trust Boundaries
- 21:28Attack Trees - Use Cases and Benefits
- 24:09Cloud Native Security Expertise
- 27:10Select Scenarios
related talks
32mThreat-Driven Development
24mPurple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud...
49mTraining for Incident Response: The Red, the Blue, and the Ugly
29mRed Teaming AWS: Practice What You Preach
12mIntroduction To Red Team Tooling And Opsec
38mThreat Modelling Kubernetes: A Lightspeed Introduction
01h 07mTutorial: Bullet-Proof Kubernetes: Learn by Hacking
41mPurple Is the New Red - Providing the Most Value from Offensive Security