Hacking and Hardening Kubernetes Clusters by Example [I] - Brad Geesaman, Symantec

Hacking and Hardening Kubernetes Clusters by Example [I] - Brad Geesaman, Symantec
While Kubernetes offers new and exciting ways to deploy and scale container-based workloads in production, many organizations may not be aware of the security risks inherent in the out-of-the-box state of most Kubernetes installations and the common practices for deploying workloads that could lead to unintentional compromise. Join Brad Geesaman, the Cyber Skills Development team lead at Symantec, on an eye-opening journey examining real compromises and sensitive data leaks that can occur inside a Kubernetes cluster, highlighting the configurations that allowed them to succeed, applying practical applications of the latest built-in security features and policies to prevent those attacks, and providing actionable steps for future detection.
The hardening measures taken in response to the attacks demonstrated will include guidelines for improving configurations installed by common deployment tools, securing the sources of containers, implementing firewall and networking plugin policies, isolating workloads with namespaces and labels, controlling container security contexts, better handling of secrets and environment variables, limiting API server access, examining audit logs for malicious attack patterns, and more.
About Brad Geesaman
Brad was recently the Cyber Skills Development Engineering Lead at Symantec Corporation where he supported the operations and delivery of ethical hacking learning simulations on top of Kubernetes in AWS. Although he spent several years as a penetration-tester, his real passion is educating others on the real-world security risks inherent in complex infrastructure systems through demonstration followed by practical, usable advice on detection and prevention.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

[@nunofernandes8857]

Excellent talk! As an admin working on AWS workloads, this blew my mind. I honestly had no idea of more than half the issues you approached. GJ!!

[@DF-bd4hl]

Very nice talk !! Thanks for all this information.

[@bmejia220]

Terrific talk I learned so much thank you

[@serverlessnomad]

Excellent work, very informative.

[@SanketPatelJ]

36:12 interesting choice of colors for the credits! First is red :)

[@isacm4029]

Indeed! very informative

[@robertdeheer1307]

Thanks, brilliant talk

[@littlebighumancom]

Great stuff. Im also curious what software he used to create the 3D diagrams

[@RobertObuchUk]

it may be www.cloudcraft.co