Hello From the Other Side

Attackers have user stories too. Are you designing with them in mind?

As an attacker, Ian Coldwater would like to help you understand these users and their stories. What do their mindsets, motivations and methodologies look like? What do attackers look for when they look at a Kubernetes context, what do they do when they get in there, and what can you do to help protect your clusters and code against them?

Being able to understand these perspectives can help you broaden your own. Let’s explore them together, and learn how to build stronger, more secure systems accordingly.

Transcript

1. HELLO FROM THE OTHER SIDE
   Dispatches From a Kubernetes Attacker @IanColdwater
   

   View Slide

2. My name is Ian Coldwater.
   I’m a Lead Platform Security
   Engineer at Heroku, a Salesforce
   company.
   I specialize in hacking and
   hardening Kubernetes, containers
   and cloud infrastructure.
   @IanColdwater
   

   View Slide

3. HI COMMUNITY!
   @IanColdwater
   

   View Slide

4. DIVERSITY
   BUILDS
   STRONGER
   SYSTEMS
   @IanColdwater
   

   View Slide

5. WHO DO YOU DESIGN FOR?
   @IanColdwater
   

   View Slide

6. ATTACKERS HAVE USER STORIES TOO
   @IanColdwater
   

   View Slide

7. WHO ARE ATTACKERS?
   @IanColdwater
   

   View Slide

8. HOW DO ATTACKERS THINK?
   @IanColdwater
   

   View Slide

9. WHAT DO YOU SEE?
   @IanColdwater
   

   View Slide

10. WHAT DO YOU SEE?
    kubectl auth can-i --list
    --namespace=kube-system
    @IanColdwater
    

    View Slide

11. WHAT DO ATTACKERS LOOK FOR?
    @IanColdwater
    

    View Slide

12. ATTACKER METHODOLOGY
    @IanColdwater
    

    View Slide

13. DESIGNING FOR DEFENSE
    @IanColdwater
    

    View Slide

14. WHAT IS YOUR THREAT MODEL?
    • What are you trying to protect?
    • Who are you trying to protect it from?
    @IanColdwater
    

    View Slide

15. WHAT’S IN YOUR GRAPH?
    • Know what you’re running, and understand it well.
    • What connects? What crosses? Where are the rough edges?
    • What would an attacker see?
    @IanColdwater
    

    View Slide

16. CHECK YOUR ASSUMPTIONS
    @IanColdwater
    

    View Slide

17. THINGS YOU CAN DO
    @IanColdwater
    

    View Slide

18. MAKE FRIENDS!
    @IanColdwater
    

    View Slide

19. GET PRACTICE
    • Capture the Flag:
    overthewire.org, picoctf.com,
    hackthebox.eu
    • goose.game
    • Play with your own systems!
    @IanColdwater
    

    View Slide

20. BETTER TOGETHER
    @IanColdwater
    

    View Slide

21. WE CAN DO IT!
    @IanColdwater
    

    View Slide

22. RESOURCES
    • Kubernetes security audit
    • attack trees
    • attackers think in graphs
    • bug bounties and black
    swans
    • CIS benchmarks
    • https://k8s.io/security
    • github.com/kelseyhightower/
    nocode - the best way to
    write secure and reliable
    applications!
    @IanColdwater
    

    View Slide