Autiting Kubernetes Access Control

A common task in any security review, is auditing user access control, as excessive numbers of privileged users are a common theme, and privileged access a common point of attack.

WSL and Docker for Windows

There’s a number of steps needed to get all this setup properly, but at the end of it you should be able to run Linux and Windows containers on a Windows host from WSL bash…

Some notes on Kubernetes Network Policies

Kubernetes network policies are a useful security feature which allow for traffic into and (sometimes) out of pods to be restricted.

Linux Capabilities and when to drop all

Somewhat following on from my previous post about running containers in non-root environments I’ve been spending some more time reading up on Capabilities, so thought it would be worth making some notes.

Network Tools in Non-Root Docker Images

As some environments which allow for Docker images to run (e.g. OpenShift Origin’s default setup) don’t allow containers to run as the root user, its worth knowing about other ways to get some networking and security tools run without having to have root.

Keeping your Docker builds fresh

Anyone who’s used images from Docker Hub will likely have noticed that there can be quite a few old and stale images up there. People will post an image to help them achieve a goal but then might not remember to maintain it, which reduces the usefulness for others over time as software versions get outdated and projects that are incorporated into the image move on. I’m guilty of this myself with quite a few images up on Hub that haven’t been updated since I initially uploaded them.

Kubernetes Attack Surface - etcd

etcd is a key element of most Kubernetes deployments as it stores the cluster state including items like service tokens, secrets and service configurations.

Container Testing - A small tools container with SSH

When you’re doing security testing of container environments one of the things that can be pretty useful is having a container with useful tools connected to the container network. From there you can run network scans of the container network and also test the scenario of “malicious container”

Some thoughts on the new OWASP Top 10 - A7

The first release candidate of the new OWASP Top 10 got released last week and one of the changes in particular seems to be generating a lot of comment, so I thought I’d chip in too with some thoughts.

Kubernetes Attack Surface - Service Tokens

Whilst spending some more time looking at Kubernetes, to help out with the forthcoming CIS Security standard, I was looking at cluster component authentication and noticed something that might not be known by everyone using Kubernetes, so I thought it’d be worth a post.