Wiz Highlights Kubernetes Security Talks from KubeCon Europe 2024
Summary
Wiz recommends KubeCon Europe 2024 talks covering Kubernetes threat intelligence, cluster policy enforcement, container image security, eBPF, privilege escalation, initial access, and attacks on managed clusters.
Key points
- A proposed Kubernetes threat-intelligence framework uses eBPF sensors to collect information and STIX/TAXII formats to process and distribute it.
- A session on securing 900 clusters compares Pod Security Admission, Validating Admission Policies, OPA, and Kyverno, including limitations encountered at scale.
- A container-image talk covers approaches to building distroless and lightweight images.
- Speakers discuss Kubernetes privilege escalation, including ways attackers may hide activity, evade detection, and persist after compromise.
- Wiz’s initial-access talk covers Kubernetes entry vectors and provides detection and protection recommendations.
- A second Wiz talk examines attacker techniques and attack chains involving middleware and services in managed GKE, AKS, and EKS clusters.
Article Details
- Topic
- Kubernetes security talks at KubeCon + CloudNativeCon Europe 2024
People
Adrian MouatPresented approaches to building distroless and lightweight container images.Andrew MartinPresented Kubernetes privilege-escalation tactics and post-compromise activities.Constanze RoedigPresented work on collecting and disseminating Kubernetes threat intelligence.Iain SmartPresented Kubernetes privilege-escalation tactics and post-compromise activities.James CallaghanPresented work on collecting and disseminating Kubernetes threat intelligence.John FastabendPresented on eBPF’s capabilities and limitations.Liz RicePresented on eBPF’s capabilities and limitations.Tjark RascheDescribed deploying admission-controller policies at scale in Kubernetes clusters.Tobias GieseDescribed deploying admission-controller policies at scale in Kubernetes clusters.
Products
AKSdetection and protection recommendations for each of those vectors. Finally, if you run managed GKE, AKS, or EKS clusters and want to know what kind of security risks they carry, you are invited to watch our talkEKSand protection recommendations for each of those vectors. Finally, if you run managed GKE, AKS, or EKS clusters and want to know what kind of security risks they carry, you are invited to watch our talk LivingGKEuseful detection and protection recommendations for each of those vectors. Finally, if you run managed GKE, AKS, or EKS clusters and want to know what kind of security risks they carry, you are invited to watch ourKubernetesBrewing the Kubernetes Storm Center: Open Source Threat Intelligence for the Cloud Native EcosystemKyvernochallenges with each method — inflexibility of PSA, policy complexity of OPA, and performance issues in Kyverno. There is something for every practitioner looking to harden their cluster setup. Open Policy Agent (OPA)while clearly demonstrating the challenges with each method — inflexibility of PSA, policy complexity of OPA, and performance issues in Kyverno. There is something for every practitioner looking to harden theirPod Security AdmissionTjark Rasche describe their policies deployment journey in Mercedes-Benz Tech Innovation, from Pod Security Admission to Validating Admission Policies, while clearly demonstrating the challenges with each method —Validating Admission Policiespolicies deployment journey in Mercedes-Benz Tech Innovation, from Pod Security Admission to Validating Admission Policies, while clearly demonstrating the challenges with each method — inflexibility of PSA, policy