Wiz Report Finds Low Kubernetes Security Maturity Across Cloud Environments
Summary
Based on scans of more than 200,000 cloud accounts, Wiz’s 2023 report finds low Kubernetes security maturity, identifies risks across attack paths, and recommends layered controls to reduce exposure and limit attacker movement.
Key points
- The report draws on analysis of more than 200,000 cloud accounts to assess Kubernetes security risks and controls.
- Wiz experiments found malicious internet scans began 22 minutes after creating an EKS cluster, 2 hours and 13 minutes after AKS creation, and in under three hours for GKE.
- Only 9% of clusters used network policies for traffic separation, while the report says adoption of available security controls is lagging.
- The report identifies data-plane vulnerabilities and opportunities for lateral movement and privilege escalation as key risks after initial access.
- It warns that attackers may pivot from Kubernetes clusters into cloud environments, and describes attacks involving cryptomining and intellectual-property theft.
- Recommendations include continuous exposure reviews, vulnerability remediation and updates, runtime protection, workload isolation, and regular IAM and RBAC reviews.
Article Details
- Publisher
- Wiz
- Report Period
- 2023
- Scope
- Kubernetes security risks, controls, and attack paths in cloud environments.
- Sample Size
- Scans of over 200,000 cloud accounts.
- Key Statistics
- Only 9% of clusters use network policies for traffic separation.
- Wiz research experiments found that malicious scans began within 22 minutes of creating an EKS cluster, 2 hours and 13 minutes for AKS clusters, and less than three hours for GKE clusters.
- Recommendations
- Continuously scan for external exposure and review externally facing security posture.
- Detect and remediate critical vulnerabilities in publicly exposed pods and services, and update clusters frequently.
- Use runtime protection to detect malicious code execution.
- Apply Pod Security Standards, namespace-based isolation, RBAC, network policies, and user namespaces to limit lateral movement.
- Continuously review IAM and RBAC hygiene for Kubernetes workloads to constrain compromise impact and prevent cloud pivoting.
MITRE ATT&CK
T1021 · Remote ServicesThe article describes attackers pivoting between Kubernetes clusters and cloud infrastructure.T1041 · Exfiltration Over C2 ChannelThe article reports attacks involving theft of intellectual property.T1496 · Resource HijackingThe article describes attackers running cryptocurrency-mining workloads on Kubernetes clusters.T1552.001 · Credentials In FilesThe article says RBAC Buster attempts to steal AWS credentials.
Malware
Products
AKScluster creation, it takes less than three hours to start receiving malicious scans from the internet. For AKS clusters, it takes 2 hours and 13 minutes. For EKS clusters this "grace period" is drastically shorter — 22EKSstart receiving malicious scans from the internet. For AKS clusters, it takes 2 hours and 13 minutes. For EKS clusters this "grace period" is drastically shorter — 22 minutes. All these numbers clearly point to theGKEis becoming a target. An experiment done by the Wiz Threat Research team shows that from the moment of GKE cluster creation, it takes less than three hours to start receiving malicious scans from the internet. ForKubernetesKubernetes (K8s) has revolutionized how cloud-native applications are deployed and managed. While its popularity is evident, there's a lack of data for making informed decisions related to managing these environments,
Tools
ccminerattacks during the last year include PyLoose and newhello. We see that established miners like XMRig, CCMiner, and XMR-Stak-RX are increasingly used to run on Kubernetes infrastructures. In addition to targetingXMR-Stak-RXthe last year include PyLoose and newhello. We see that established miners like XMRig, CCMiner, and XMR-Stak-RX are increasingly used to run on Kubernetes infrastructures. In addition to targeting cryptominingXMRigof such attacks during the last year include PyLoose and newhello. We see that established miners like XMRig, CCMiner, and XMR-Stak-RX are increasingly used to run on Kubernetes infrastructures. In addition to