30 Sep Presentation: Orchestrated Containers and How to Hack Them

Kubernetes dropped into the scene in 2014 as a gift from Google, promising to help simplify the dev/ops workflow by moving to immutable, idempotent infrastructure-ascode setups. It’s seen rapid adoption in the last couple of years with managed offerings from Amazon AWS, Microsoft Azure, and Google GCP.

Unfortunately, this world of containers comes with a false sense of security and many of the defaults for Kubernetes leave your environments wide open to attack.

Confusing documentation, insecure defaults, and overall ecosystem immaturity lead to drastic gaps in environmental security, and monitoring, reducing your organisation’s capacity to detect, prevent, and respond to a malicious actor attacking your containerised assets – a situation that has been capitalised on by managed security vendors charging tens of thousands of dollars for domain experience that never trickles down into the core of your deployment strategies.

Luckily, with a few simple pointers the sky will no longer be falling.

This presentation focuses on attack paths we take, and points of interest we look at, when performing orchestrated containerised environment security reviews.

It looks at common mistakes and low-hanging fruit in network configurations and authorisation policies, as well as supplemental configurations and automated policy enforcement to harden your environment and raise the bar.

To learn more download the presentation here. For more information call us on 1300 922 933.