Kubernetes Goat - Practical Approach to Learn Kubernetes Security

In this session, Madhu Akula will present how to get started with Kubernetes Goat by exploring different vulnerabilities in Kubernetes Cluster and Containerised environments. He will also demonstrate the real-world vulnerabilities and map the Kubernetes Goat scenarios with them. As a defender you will see how we can learn these attacks, misconfigurations to understand and improve your cloud native infrastructure security posture.

https://www.alldaydevops.com/addo-speakers/madhu-akula

Transcript

1. TRACK: DEVSECOPS NOVEMBER 12, 2020 Madhu Akula Kubernetes Goat Practical Approach to Learn Kubernetes Security
2. TRACK: DEVSECOPS • Creator of Kubernetes Goat, Hacker Container, tools.tldr.run, many other OSS projects. • Speaker & Trainer at Blackhat, DEFCON, GitHub, USENIX, OWASP, All Day DevOps, DevSecCon, CNCF, c0c0n, Nullcon, SACON, null, many others. • Author of Security Automation with Ansible2, OWASP KSTG, DevSecOps whitepaper, etc. • Technical reviewer (multiple books) & Review board member of multiple conferences, organizations, communities, etc. • Found security vulnerabilities in 200+ organizations and products including Google, Microsoft, AT&T, Adobe, WordPress, Ntop, etc. • Certified Kubernetes Administrator & Offensive Security Certified Professional, etc. • Never ending learner! About Me
3. TRACK: DEVSECOPS What is Kubernetes Goat? Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.
4. TRACK: DEVSECOPS Disclaimer Kubernetes Goat creates intentionally vulnerable resources into your cluster. DO NOT deploy Kubernetes Goat in a production environment or alongside any sensitive cluster resources.
5. TRACK: DEVSECOPS Current Scenarios in Kubernetes Goat! 1. Sensitive keys in code bases 2. DIND (docker-in-docker) exploitation 3. SSRF in K8S world 4. Container escape to access host system 5. Docker CIS Benchmarks analysis 6. Kubernetes CIS Benchmarks analysis 7. Attacking private registry 8. NodePort exposed services 9. Helm v2 tiller to PwN the cluster 10. Analysing crypto miner container 11. Kubernetes Namespaces bypass 12. Gaining environment information 13. DoS the memory/cpu resources 14. Hacker Container preview 15. Hidden in layers 16. RBAC Least Privileges Misconfiguration 17. KubeAudit - Audit Kubernetes Clusters 18. Sysdig Falco - Runtime Security Monitoring & Detection 19. Popeye - A Kubernetes Cluster Sanitizer 20. Secure network boundaries using NSP More coming soon….
6. TRACK: DEVSECOPS • Ensure you have admin access to the Kubernetes cluster ◦ Refer to kubectl releases for binaries https://kubernetes.io/docs/tasks/tools/install-kubectl/ • Verify by running kubectl version • Ensure you have helm version 2 setup in your path as helm2 ◦ Refer to helm version 2 releases for binaries https://github.com/helm/helm/releases ◦ Verify by running helm2 version • To set up the Kubernetes Goat resources in your cluster, run the following commands git clone https://github.com/madhuakula/kubernetes-goat.git cd kubernetes-goat bash setup-kubernetes-goat.sh Kubernetes Goat Setup
7. TRACK: DEVSECOPS https://katacoda.com/madhuakula/scenarios/kubernetes-goat Kubernetes Goat - Without Setup 😎
8. TRACK: DEVSECOPS Demo Time!
9. TRACK: DEVSECOPS • Attackers/Red Teams ◦ Learning how to attack/find security issues with in containers, Kubernetes and similar environments and workloads to exploit and gain access • Defenders/Blue Teams ◦ Understanding best practices, learning how attackers works to apply defense, practicing the attacks, misconfigurations to apply defense and detection • Security Vendors ◦ Using Kubernetes Goat to showcase the effectiveness of the tools/product, helping educate the customers and sharing their knowledge in an interactive hands-on way • Architects/Engineers/Consultants/Developers/Users/etc… ◦ Learning and Practicing • Share it with your friends, colleagues, everyone. Provide your valuable feedback, contributions, and suggestions Key Takeaways!
10. TRACK: DEVSECOPS Thank You! @madhuakula https://madhuakula.com