Kubernetes meetup k8s_aug_2019
- 1. ©2018 Lacework, Inc. Confidential and Proprietary.
- 2. ©2018 Lacework, Inc. Confidential and Proprietary.
- 3. ©2018 Lacework, Inc. Confidential and Proprietary. 3 Automating Cloud Security at Scale
- 4. ©2018 Lacework, Inc. Confidential and Proprietary. 4 Lacework Polygraph Threat Intelligence and API’s Alerting SIEM SOC InvestigationCompliance DetectionVisibility Cloud Infrastructure Workloads Accounts VMs ContainersFilesApps Insiders Config APIs Use cases Lacework Security Platform for Cloud
- 5. ©2018 Lacework, Inc. Confidential and Proprietary. • Networking • Redundancy • Autoscaling • Provisioning • Storage • Alerting
- 6. ©2018 Lacework, Inc. Confidential and Proprietary.
- 7. ©2018 Lacework, Inc. Confidential and Proprietary. Do believe the hype! Never heard of it Looking into it M igration planned M igration done W eshould secureit!
- 8. ©2018 Lacework, Inc. Confidential and Proprietary. ku · ber · net · es co ·nun ·drum Speed & Scale Secure & Safe
- 9. ©2018 Lacework, Inc. Confidential and Proprietary. The Firewall is the security! Zero-Trust for all Window of Opportunity
- 10. ©2018 Lacework, Inc. Confidential and Proprietary. Monocultures are hard to secure!
- 11. ©2018 Lacework, Inc. Confidential and Proprietary.
- 12. ©2018 Lacework, Inc. Confidential and Proprietary. Hunting Examples with Shodan
- 13. ©2018 Lacework, Inc. Confidential and Proprietary. Demo of Shodan
- 14. ©2018 Lacework, Inc. Confidential and Proprietary.
- 15. ©2018 Lacework, Inc. Confidential and Proprietary. Container Risks and Threats
- 16. ©2018 Lacework, Inc. Confidential and Proprietary. Container Risks and Threats
- 17. ©2018 Lacework, Inc. Confidential and Proprietary. K8’s is the Leader
- 18. ©2018 Lacework, Inc. Confidential and Proprietary. Oh my, HealthZ RCE
- 19. ©2018 Lacework, Inc. Confidential and Proprietary. Risks and Threats • Full remote administration • Information discovery • Deploy Images • Delete Pod’s • Deploy decoys • Use your imagination • Information Disclosure on targets with invalid certificates • Full RCE (https://www.shodan.io/search?query=healthz+probe)
- 20. ©2018 Lacework, Inc. Confidential and Proprietary. Recommendations • Regardless of network policy, use MFA for all access; • Apply strict controls to network access, especially for UI and API ports; • Use SSL for all servers and use valid certificates with proper expiration and enforcement policies; • Investigate VPN (bastion), reverse proxy or direct connect connections to sensitive servers; • Look into product and services such as Lacework in order to discover, detect, prevent, and secure your container services. • Build a pod security policy • Configure your Kubernetes pods to run read-only file systems • Restrict privilege escalation in Kubernetes • Deploy RBAC Kubernetes
- 21. ©2018 Lacework, Inc. Confidential and Proprietary. Pod Security Policy : prevent running as root source Bitnami
- 22. ©2018 Lacework, Inc. Confidential and Proprietary. Pod Security Policy source Bitnami $kubectl get psp
- 23. ©2018 Lacework, Inc. Confidential and Proprietary. Pod Security Policy: prevent pods from accessing host ports source Bitnami
- 24. ©2018 Lacework, Inc. Confidential and Proprietary. Pod Security Policy: prevent access to certain volume types source Bitnami
- 25. ©2018 Lacework, Inc. Confidential and Proprietary. Containers Security in Polygraph 25
- 26. ©2018 Lacework, Inc. Confidential and Proprietary. Automating Cloud Security at Scale 26