Intro to k8s Security - or Taming the Great Spaghetti Monster!
No ratings
Presented at BSidesTampa 2019 by
We've all heard of it - Kubernetes or k8s - but do you really know what it is and more importantly, how to setup security? The Great Spaghetti Monster (as I like to think of it) is not too difficult to secure if you just stop and use common sense security best practices. Yes, I did just use "common sense" and "Security" in the same sentence! This talk is for everyone - even those who have been playing with k8s for sometime. First we open with a brief intro to "containers" and more specifically docker. This is to make sure everyone is on the same playing field before we jump into securing things. Next we introduce Kubernetes and the magic world of "orchestration" - and what it really means to orchestrate containers. Now the fun begins as I bring up a small Raspberry Pi Stack with Kubernetes on it to show a live cluster with "visual aides" (very bright LEDs that are visible and will show containers jumping from node to node) As the brief k8s demo concludes, now it is time to bring in security by demonstrating the security plugins and tools used. The focus on this is:1. Security Threats to a Kubernetes Cluster and Containers2. Tools to secure the CI/CD or Build Pipeline3. Tools for monitoring and Auditing the ClusterSummary time! Let's bring it all to a neat and clean summary of how we have addressed many of the typical attack vectors in containers and k8s clusters be integrating OSS (and other) tools into the mix. The entire talk uses live demos keeping a very interactive flow to keep the audience engaged - and of course all demos have a back-up "video" because we all know how live demos work. :-) Of note: Although this talk is listed below as Introductory - It is presented in such a way, that even those with experience in k8s and container security will learn something new. This is done because one of the demo containers is an IoT honeypot and a quick summary of how this expands your threat modeling, as well as presenting a new way to launch Honeypots.