Kubernetes Security: Attacking and Defending K8s Clusters

This presentation aims to talk about different attack scenarios leveraging Kubernetes clusters. We'll dig deeper into a real-world attack scenario using real-world applications to demonstrate different ways attackers and malicious users can use to exploit your cluster and the applications running on it. But first, we’ll give an overview about Kubernetes and its architecture, covering the main components from the Control Plane and the Worker Nodes. Then, we'll use the K8s Threat Matrix and the MITRE ATT&CK for Containers published this year to discuss the Tactics, Techniques and Procedures to demonstrate the Recon, Exploitation and Post-Exploitation phases. After that, we'll provide some best practices to securing your cluster based on the scenarios and the CIS Benchmarks for Kubernetes. We'll show how to use Role-based access control (RBAC) for Access Control, to enable audit logs for security and troubleshooting, and we'll set up some network policies to avoid communication between pods and prevent any lateral movement from attackers.
About the Speaker
Magno Logan @magnologan, Information Security Specialist, Trend Micro
Magno Logan works as an Information Security Specialist for Trend Micro. He specializes in Cloud, Container and Application Security Research, Threat Modelling and Red Teaming. He has been tapped as a resource speaker for numerous security conferences around the globe. He is also a member of the CNCF SIG-Security team.
SANS Institute Summits at www.sans.org/cyber-security-s... SANS Cloud Security Curriculum, www.sans.org/cloud-security/ SANS Cloud Security on Twitter: @SANSCloudSec
SANS Cloud Security on LinkedIn: / sanscloudsec

[@abdoelrahmanhegazy]

Great talk Magno, Can you guys share the slides if they are public ? Thanks

[@SANSCloudSecurity]

Hi Abdel, you can get the slides if you create / login to your sans.org portal account.

[@AbhayAR]

Can you show me the path how to get this slides