►
From YouTube: Applying Least Privileges through Kubernetes Admission Controllers - Benjy Portnoy, Aqua Security
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18).
Applying Least Privileges through Kubernetes Admission Controllers - Benjy Portnoy, Aqua Security (Intermediate Skill Level)
An admission controller intercepts requests to the Kubernetes API server prior to persistence of the object. By applying proper admission controls in your Kubernetes cluster, it's possible to generate deployments that adhere to the least privilege model, limiting user and container activity based on their business usage needs.
In this session, we will review the latest and greatest Kubernetes 1.9 admission controller capabilities, we will demonstrate in a live demo a dynamic admission control webhook that can be customized to limit privileged user access.
About Benjy Portnoy
Benjy is a seasoned cyber security professional with over 15 years experience in consulting, designing, and implementing strategic information security projects for organizations across EMEA. He is currently the director of DevSecOps at Aqua Security, helping enterprises streamline security into their DevOps processes to help secure their containerized applications. Prior to joining Aqua Security, Benjy held senior security architect roles at CA, BlueCoat, and Symantec where he worked closely with CSO’s and security operations teams focusing on vulnerability management, datacenter security, and incident response. Benjy holds both CISA (Certified Information Systems Auditor) and CISSP (Certified Information Systems Security) certifications and is currently completing his master's degree in Information Security and Digital Forensics.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
Join us for KubeCon + CloudNativeCon in San Diego November 18 - 21. Learn more at https://bit.ly/2XTN3ho. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Good
morning,
everyone
nice
to
see
you
here
how
many
people
are
hungover,
so
our
topic
today
is
fascinating.
It's
about
applying
security,
best
practices,
specifically
lease
privileges
in
your
Cuban
atley's
cluster.
So
before
we
get
started,
who
can
tell
me
what
lease
privileges
is
any
volunteers?
Yes,.
A
Good,
don't
give
any
credentials,
you
don't
need.
The
official
definition
is
every
user
in
any
environment
should
have
the
minimum
privileges
required
to
fulfill
their
job
function.
If
we
take
an
auditor
in
a
kubernetes
cluster
as
a
very
simple
example,
if
I'm,
an
auditor
I
should
be
able
to
run
COO
control
logs
on
my
pod,
but
not
necessarily
stop
or
start
a
pod.
Now,
I
would
like
to
give
you
a
more
palpable
example.
A
However,
this
morning,
at
our
hotel,
I
noticed
a
pretty
serious
security
breach
where
someone
managed
to
kind
of
go
beyond
what
their
official
role
was
breaking
break
the
security
clearance
in
the
hotel
and,
as
you
can
see
here,
the
water
bottle
was
actually
used
for
something
else
entirely,
not
what
it
was
intended
for,
and
actually
this
was
caught
on
camera.
We
don't
know
how
this
guy
broke
in.
A
To
do
this
in
the
hotel,
he
should
have
had
access
only
to
his
bedroom,
but
he
managed
to
break
into
the
bar
fill
these
with
with
beer,
and
actually
it
didn't
stop
there,
because
what
hackers
do
once
they're
inside
your
network,
they
try
and
elevate
their
privileges,
so
he
didn't
stop
with
the
beer,
but
he
tried
to
actually
get
involved
with
the
whisky
as
well.
Now,
when
this
happened,
someone
came
over
and
and
kind
of
stopped
everything
that
was
happening.
A
A
You
sure
all
right,
because
this
book
doesn't
exist,
I
made
it
up,
but
you're
gonna
get
one
of
these
free
bits
off
to
it.
So
I'm
pleased
that
you've
read
the
book.
So
why
is
there
so
much
noise
about
hackers
breaking
in
two
to
two
servers
and
big
organizations
to
mine
crypto
currencies?
We
all
know
there
are
high-profile
cyber
attacks
every
day.
There's
nothing
new
about
this.
The
reason
that
this
is
getting
attention
is
because
kubernetes
clusters
are
becoming
more
and
more
ubiquitous.
A
Hackers
are
starting
to
use
them
and
leverage
them
to
exploit
vulnerabilities
and
misconfigurations
to
penetrate
organizations.
One
of
the
most
notorious
examples
of
this
is
Tesla.
Last
year,
Tesla
put
a
publicly
facing
on
the
Internet
kubernetes
cluster,
where
the
kubernetes
dashboard
was
enabled
with
anonymous
authentication.
Okay,
what
that
means
is
as
soon
as
the
hackers
got
into
that
dashboard.
A
A
So
the
issue
here
is
not
that
kubernetes
is
not
secure.
Kubernetes
has
done
an
incredible
job
of
explaining
how
to
secure
kubernetes
clusters.
The
issue
is
that
many
of
the
flavors
and
the
default
installations
of
kubernetes
are
not
secure
by
default.
One
of
the
key
tenants
of
information
security
best
practices
is
that,
if
you
don't
start
with
something
that
is
secure
by
default,
it
only
goes
downhill
from
there
and
there
is
a
big
knowledge
gap
in
the
information
security
industry.
A
Where
say,
cops
and
CISOs
are
still
learning
how
containers
work,
how
orchestrators
like
kubernetes
work
and
the
people
like
many
of
you
in
the
room,
the
sres
or
the
devops
people.
They
just
want
things
to
work,
they're
less
concerned
with
security,
and
that
is
created
a
kind
of
very
interesting
opportunity
to
empower
DevOps
and
ensure
that
the
kubernetes
environments
are
really
locked
down
and
secured
from
day
one
now.
Everyone
in
the
room
is
familiar
with
social
engineering
attacks.
A
When
a
hacker
wants
to
break
into
an
organization,
they
will
usually
try
and
convince
an
unsuspecting
victim
to
click
on
a
link
in
an
email
to
install
malware.
This
has
been
happening
for
years
via
email,
phishing
attacks
by
the
way
github
has
had
a
not
a
few,
but
I
would
say
over
the
last
few
years.
More
and
more
hackers
are
using
open
source
kind
of
platforms
like
github
to
host
malware
and
try
and
convince
unsuspecting
victims
to
click
and
install
malware.
A
A
You
get
one
of
the
free,
biz
woo
excellence
that
we've
all
done
this
now
as
more
and
more
organizations
are
using
kubernetes
we're
seeing
the
bad
guys.
If
I
want
to
convince
someone
to
install
a
daemon
set
that
contains
malware,
it
doesn't
have
to
be
crypto
mining.
Any
malware
I
can
send
you
a
link
that
says
check
out
this
great
free
tool.
All
you
need
to
do
is
coop
control.
F
s,
RI
tools.com!
It
should
be
s.
Re,
Tools,
calm,
okay,
fake,
a
camel.
Now
what
happens
is
when
you
do
that?
A
Obviously,
that's
gonna
be
spread
out
in
your
cluster.
Most
of
the
existing
security
tools
out
there
will
not
have
any
visibility
into
what's
going
on
so
the
intrusion
prevention
system,
the
firewalls,
the
anti-malware,
are
completely
oblivious
to
the
fact
that
a
devops
guy
just
installed
whatever
that
application
was
into
their
cluster
environment,
okay,
so
that
creates
a
unique
challenge
for
the
security
teams.
So
if
we
look
at
what
is
kubernetes
done,
they
have
done
an
incredible
job
documenting,
and
this
is
on
the
cuba
Nettie's
website.
A
So
most
of
the
things
you
see
here
while
they
exist
in
kubernetes,
they
are
still
not
the
default
configuration
which
requires
obviously,
a
lot
of
changes
and
administration
to
be
done
by
the
administrator
admission
controllers,
which
is
the
topic
of
our
talk
today
very
powerful,
we're
going
to
talk
how
these
can
be
leveraged
to
really
secure
your
kubernetes
environment.
So
there
are
really
at
admission
controller.
It
operates
on
the
API
server,
essentially
in
intercepts
or
requests
to
the
API
server
prior
to
the
persistence
of
that
object
into
the
HCV
database.
A
A
So
if
you
look
here
at
a
very
simple
graph
in
kubernetes,
so
we
have
here
the
user,
the
pods
or
the
service
accounts,
they're
authenticating,
usually
with
a
certificate.
The
authentication
authorization
has
happened.
It
will
then
hit
the
admission
controller
before
that's
persisted
into
the
data
and
we'll
see
why
the
admission
controllers
are
so
powerful.
Why
do
you
need
them?
A
Essentially
without
them,
kubernetes
has
the
functionality
is
minimal.
You
can
do
a
lot
of
things,
but
if
you
want
to
extend
and
have
more
control,
more
granular
control,
especially
from
a
security
standpoint,
admission
controllers
can
really
be
leveraged
to
enhance
the
security
posture
of
your
cluster.
So
there
are
two
types
of
admission
controllers:
there
are
mutating
and
validating
mutating
admission
controllers.
Allow
you
to
actually
modify
the
object
before
it
is
persisted
into
the
HCD
database
validating
it
just
validates
the
request,
but
not
actually
changing
anything,
and
there
are
static
and
extensible
or
dynamic
admission
controllers.
A
Static
are
cannot
be
changed,
so
they
have
to
be
kind
of
recompiled
into
the
kubernetes
binary.
Obviously,
that's
a
drawback,
but
we're
seeing
more
and
more
what's
known
as
extensible
admission
controllers,
these
are
essentially
dynamic
and
they
can
be
run
and
changed
in
run
time
without
you
needing
to
recompile
your
kubernetes
binary.
Okay.
A
Now
because
there
are
essentially
with
a
dynamic
admission
controller,
you
have
a
request:
that's
going
to
an
API
to
a
webhook
server
or
an
API.
On
the
other
side,
those
ideally
should
be
hosted
within
your
kubernetes
cluster.
Yes,
they
are
encrypted,
but
you
don't
want
to
have
that,
leaving
the
environment
so
from
a
security
best
practice
point
of
view
that
should
be
inside
your
kubernetes
cluster.
Let's
take
a
look
at
look
at
the
API
server
llamó
file,
and
we
can
see
here
that
we
have
the
admission
controller.
A
So
this
is
for
kubernetes
110.
These
are
the
recommended
and
mission
controllers
that
should
be
used.
These
are
very
powerful,
however.
Not
all
of
these
are
specifically
dedicated
to
the
security.
What
I'm
going
to
try
and
do
is
explain
to
you
how
we
can
you
additional
ones
for
the
security
posture?
Can
they
want
to
tell
me
what
layered
security
the
term
laid
security?
A
You
already
got
one
bit,
you
can
only
answer
once
yeah
that
was
privileged
escalation,
so
defense
in
depth
or
late
security
is
where
and
traditional,
let's
just
say
before
the
world
of
containers.
If
I
had
a
traditional
VM
or
a
server
in
my
data
center,
I
would
have
a
firewall
on
the
periphery
intrusion
prevention
system,
anti-malware
host
hardening,
essentially
that,
if
even
if
a
hacker
manages
to
compromise
one
area
of
that
environment,
that
doesn't
necessarily
mean
that
the
entire
area
is
compromised.
We
have
to
think
of
security
for
kubernetes.
A
In
the
same
with
the
same
mindset,
meaning
you
can
use
many
of
these
admission
controllers
to
lock
down
and
secure
your
cluster,
are
they
all
there
by
default?
No,
but
do
we
need
to
start
using
them
and
creating
kind
of
a
mindset
and
educating
the
security
teams?
The
answer
is
absolutely
yes,
so
one
thing
I
would
say
when
you
go
back
to
your
organization's
of
this
conference,
if
you
can
talk
to
the
security
people
and
explain
to
them
that,
yes,
kubernetes
is,
has
all
the
security
mechanisms
and
techniques
to
secure
it.
A
It
may
not
be
there
by
default,
but
you
can
sit
down
with
them
and
explain
how
you
can
do
this.
So,
let's
take
the
first
one,
always
pull
images.
What
happens
today
if
I'm
running
a
pod
on
my
kubernetes
cluster
I,
pull
down
that
pod
and
then
essentially
anyone
else
that
knows
the
image
name,
image
and
tag?
Okay,
assuming
it's
been
it's
on
the
same
node
will
have
access
to
that
to
the
same
image
for
their
own
pods,
if
they're
not
using
always
pull
images.
So
if
you
enable
this
always
Paul,
Emmett
is
admission
controller.
A
It
means
that
every
user
is
required
to
authenticate
every
time
a
pod
is
run.
This
is
very
important.
Let's
give
an
example.
If
you
have
a
multi
tenant
cluster,
you
have
multiple
users
on
that
cluster,
so
you
want
to
ensure
that
every
time
at
any
user
or
different
tenants
tries
to
create
a
pod
or
a
daemon
set
that
you'll
have
two
authenticate
to
the
registry
and
pull
down
the
image.
Here's
another
example
deny
escalating
exec,
so
you
all
know
that
there
are,
you
can
run
containers
whole
pods
in
privilege
mode.
A
They
can
have
access
to
the
hosts
pit
namespace
there
was
IPC
namespace.
This
is
obviously
very
bad
thing
from
a
security
standpoint,
because
if
someone
manages
to
compromise
that
container,
essentially
they
can
relatively
easy
get
access
to
the
underlying
host.
That
is
something
you
want
to
prevent.
So
when
you
have
the
deny
escalating,
exec
admission
control
that
enabled,
even
if
you
have
a
container
that's
running
with
privileged
permissions,
the
user
will
not
be
able
to
do
something
like
this
run.
A
A
What
security
policy
this
is
available,
I
think
since
kubernetes
won
seven
or
maybe
1/8.
This
is
key
to
locking
down
your
your
pods
and
ensuring
that
the
security
posture
of
your
cluster
is
not
compromised.
What
this
allows
you
to
do
is
essentially
define
what
kind
of
containers
or
what
privileges
do
they
contain?
Will
the
container
in
this
pod
have,
for
example,
can
it
run
as
a
privileged
container?
What
will
be
the
UID
or
the
GHG
ID?
A
That
can
run
this
container,
for
example,
best
practices
mandates
that
we
don't
run
containers
with
UID
0,
there's
no
reason
that
the
container
should
be
running
with
root
privileges.
Is
there
a
second
profile
applied
to
my
pod?
Ok,
am
I
looking
at
specific
system
calls
to
understand
whether
this
is
being
the
weather
system?
Calls
that
are
not
required
are
being
used
and
abused
within
my
pod,
SC
Linux,
app
armour
profile
depend
depending
on
the
Linux
flavor.
You
can
use
the
pod
security
policy
to
apply
se
Linux
or
app
Armour
profiles
to
the
pod.
A
Now,
without
this
admission,
control
enabled
this
policy
will
not
be
effective.
So
this
is
really
key.
You
need
to
have
this
admission:
control
enabled
to
be
able
to
use
pod,
secure
policy,
and
this
is
definitely
I
would
say
one
of
the
top
three
security
capabilities
that
are
built
in
to
kubernetes.
A
A
Hackie
things
yeah,
so
hockey
things
is
a
great
definition.
I'm
gonna
use
that
term.
Thank
you.
You'll
also
get
a
beer
afterwards,
so
this
is
actually
affected,
kubernetes
from
one
three,
two
one,
nine.
So
it's
not
like
an
old
version
thing,
and
this
was
about
a
month
ago.
This
vulnerability
essentially
allows
a
malicious
user
using
the
hosts
path
to
essentially
break
out
of
that
pod
and
compromise
the
underlying
host
itself
so
think
about
the
possibilities.
If
I'm,
a
hacker
from
the
pod
I,
can
access
and
modify
the
underlying
host
operating
system.
A
Obviously
that
is
something
very
bad.
Using
the
pod
security
policy.
You
can
disable
this
house
host
path,
volume
and
that's
obviously
key.
That's
a
way
to
address
this
vulnerability.
So
why
is
this
important?
Because
you
don't
have
to
wait
for
kubernetes
to
come
and
update
the
security
fix
if
you're
using
the
best
practices-
and
you
have
pod
security
policy,
a
malicious
user
would
not
be
able
to
compromise
this
particular
vulnerability.
A
Node
restriction
is
another
one
where
we
can
limit,
essentially
which
couplets
or
which
pods
can
be
accessed
via
each
node.
Why
this
important?
We
want
to
prevent
something
that
we
call
inch
report
data
leakage,
meaning
that,
just
because
I'm
sitting
on
a
node
that
has
multiple
pods
I
shouldn't
be
able
to
access
the
manifests
of
the
of
the
other
pods
on
that
node
or
the
secrets
that
it
be
mounted
with
imports
on
the
same
node
can
I
want
to
tell
me
what
this
is.
A
Okay,
so
this
is
a
fork
bomb.
It's
a
simple
batch
function
been
around
for
a
long
time.
If
you
run
this
without
having
the
required
C
group
controls
on
any
Linux,
pretty
much
well,
not
any
Linux,
but
many
many
Linux
distributions
out
there.
It
will
perform
a
denial
of
service
attack
within
about
30
seconds
and
bring
down
your
host
literally.
It
sounds
ridiculous.
This
is
the
most
primitive
form
of
denial
of
service
attack.
A
Again,
all
that's
required.
You
go
into
your
shell.
You
run
that
you
hit
enter.
The
machine
will
be
dead
within
about
30
to
40
seconds.
What
happens
is
it
goes
into
a
loop
is
essentially
consuming
all
the
ant
resources
of
that
host,
so
it
will
go
into
a
loop,
add
more
and
more
fork
and
then
fork
the
fork
again
again,
as
you
can
see
here,
and
it
used
to
be
used
by
hackers.
It's
assuming
you
have
cgroups
configured
correctly.
It
should
never
happen.
A
But
again,
if
you
haven't
configured
the
underlying
host
operating
system,
as
you
should,
if
I
managed
to
get
into
an
shell
and
the
shell
in
that
pod,
right,
I
can
potentially
compromise
and
bring
down
the
host
in
every
other
pod
on
that
host.
So
using
resource
quota
again
another
admission
controller.
We
can
limit
things
like
memory
and
CPU
consumption
for
our
pods,
so
it
ensures
that
if
someone's
trying
to
bring
down
or
consume
all
our
result,
resources
during
denial
of
service
attack,
this
would
be
prevented
using
this
environment
image
policy
webhook.
A
This
is
a
key
one.
As
you
know,
many
many
images
contain
vulnerabilities,
exploits
things
like
embedded
secrets
that
can
put
the
organization
at
risk.
For
example,
is
my
image
running
as
UID
0?
Does
it
have
to
so
by
implementing
a
webhook
which
is
an
extensible
admission
controller
at
runtime
when
I
try
and
use
an
image,
we
can
essentially
get
that
image
checked
by
a
third
party
and
say:
is
this
image
secure?
Has
it
been
signed?
A
Do
we
know
that
this
the
integrity
of
the
image
has
not
been
compromised,
and
if
there
are
critical
vulnerabilities
in
that
image,
then
obviously
we
want
to
prevent
that
image
from
running
compromising
environment.
So
here's
an
example:
okay.
This
is
a
very,
very
old
version
of
nginx
that
no
one
should
be
using.
It
has
about
51
critical
vulnerabilities
in
that
image
if
I,
try
and
deploy
daemon
sets,
as
you
can
see
here,
coop
control
create
nginx
llamo
in
this
case.
What's
happening
is
that
this
kubernetes
cluster
is
contacting
the
Aqua
security
image
assurance
capability.
A
Now
this
is
just
one
example.
Okay,
there
are
many
I
would
say
admission
controllers
that
can
do
similar
things
what's
happening
here
is
that
we
are
checking?
Is
this
image
vulnerable?
Does
it
contain
any
vulnerabilities
or
secrets
or
anything
else,
or
has
it
been
compromised
and
do
I
want
to
expose
that
risk
to
my
organization?
So,
what's
key
is
that
this
is
not
actually
getting
to
the
ED
CD
database,
right,
it's
being
intercepted
by
the
admission
control
at
runtime.
A
We
are
checking
parameters
that
have
been
defined
in
this
case
by
Accra
security
and,
depending
on
the
policy,
that's
been
defined,
we're
either
allowing
or
blocking
that
image
and
enabling
it
to
run
so.
Some
other
very
powerful
tools
that
I'm
going
to
talk
about
number
one
is
Q
bench
by
our
very
own.
Liz
Rice
Q
bench
will
take
the
CIS
benchmark.
Cis
is
the
center
of
Internet
security.
A
They
have
created
a
kubernetes
best
practice,
both
docker
and
kubernetes,
and
qu
bench
as
I'll
show
you
in
a
second
will
allow
you
to
basically
automate
and
do
a
security
assessment
of
your
kubernetes
cluster
q,
panther,
which
I'll
talk
about
cube,
Seck
and
also
from
our
friends
at
control,
plane
the
coop
sec
ILO.
So
let
just
go
through
some
of
these
here's
an
example
of
the
Q
bench.
By
the
way,
these
tools
are
all
free.
You
can
all
go
to
argot
haven't
download
them
today,
so
C
is
benchmark,
as
you
can
see.
A
If
every
single
test
will
give
you
either
a
pass
or
a
fail
and
recommend
how
to
remediate.
So
this
is
key.
If
you
talk
to
your
security
operations
person
today
and
say
how
do
we
lock
down
or
kubernetes
cluster,
it's
likely
they'll
have
no
idea.
You
may
have
other
vulnerability
assessment
tools
in
the
organization,
but
there
was
no
about
VMs.
There
was
no
about
host
operating
systems.
They'll
typically
not
know
how
to
look
inside
an
image
or
look
at
the
configuration
of
kubernetes.
That's
what
the
CIS
benchmark
tool
does
another
tool.
A
Well,
that
we
recently
released
is
our
coupon
tar.
This
is
incredibly
powerful.
It
allows
you
to
do
a
penetration
test.
Essentially,
I
want
to
assess
the
security
posture
of
my
kubernetes
cluster.
We
do
this
by
scanning,
you
give
it
like
whoo.
Anyone
know
end
map
in
the
room.
Right
almost
every
hand
went
up
so
think
of
end
map
for
kubernetes,
so
we
specify
our
subnet.
It
will
look
for
kubernetes
API
servers.
It
will
then
try
and
identify
critical
vulnerabilities,
for
example,
is
my
gooblat
running
on
an
unsecured
port
which
many
default
kubernetes
installations
still
do?
A
Is
it
does
it
have
that
infamous
dashboard
enabled
with
anonymous
authentication
like
a
good
friends
at
Tesla
hat?
We
want
to
prevent
that
from
happening
again
as
an
example,
coops
are
Keio
by
control
plane.
This
is
a
tool
where
you
can
specify
your
llamo
file
and
they've
developed
their
own
kind
of
attack
framework
where
they'll
score,
based
on
the
configuration
of
your
llamo
file.
Do
you
comply
or
do
you
violate
with
kubernetes
security,
best
practices?
A
And
finally-
and
this
is
just
a
key
thing
about
the
Aqua
micro
scanner-
so
I'm
gonna
show
you
in
a
second
how
the
micro
scanner
can
be
used,
but
one
of
the
key
issues
today
is
that,
even
if
your
kubernetes
cluster
is
secured,
if
you
have
a
pod
running
and
that
pod
contains
a
critical
vulnerability
or
malware
in
the
pod,
it's
going
to
be
very
hard
to
be
able
to
secure
that
environment.
You're
all
familiar
with
the
term
shift
left
security.
A
So
what
this
free
Microscan
it
does
allows
you
to
embed
the
security
assessment
at
build
time
inside
your
image.
This
is
incredibly
powerful.
This
is
even
before
you
get
into
your
pipeline.
You
can
run
this
on
your
laptop.
Take
an
image,
take
your
docker
file
and
when
you
build
your
image
based
on
that
docker
file,
you
add
two
simple
lines:
micro
scanner,
like
you,
can
see
here,
the
micro
scanner
will
essentially
scan
every
layer
and
every
file
in
that
image
and
say
what
vulnerabilities
have
we
found?
What
security
risks
does
pose
to
the
organization?
A
A
You'll
see
the
output.
This
isn't
it
as
an
example
okay.
So
this
is
a
vulnerability
that
we
found
for
every
vulnerability.
This
is
key.
You
have
both
the
MVD
score
and
the
the
vendor
score.
Mvd
is
the
national
vulnerability
database
now?
Why
is
it
important
to
have
both
of
those?
Because
there
are
many
security
tools
out
there,
both
commercial
and
free,
that
generate
a
lot
of
noise,
a
lot
of
vomit
false
positives?
A
What
we've
done
here
is
try
and
create
a
tool
that
separates
the
music
from
the
noise,
meaning
that
we
want
to
ensure
that
if
we
identify
a
vulnerability,
it's
not
simply
based
on
the
hash
of
that
file,
but
we're
looking
at
things
like
back
ports.
So,
for
example,
if
there's
a
vulnerable
version
of
Apache
inside
a
particular
Red
Hat
CentOS
version,
we
want
to
check.
Has
that
been
back
ported
and
has
that
been
fixed
in
that
particular
distribution?
A
I,
don't
want
to
receive
a
critical
alert
about
the
critical
vulnerability
if
that's
not
relevant
in
the
context
of
this
Red
Hat
package.
So
we've
done
a
lot
of
work
with
the
accuracy
BER
research
team
to
ensure
that
when
we
identify
something
is
not
simply
based
on
the
hash
of
the
file
that
we're
looking
at
the
context
of
that
environment
at
the
image
and
the
the
distribution
that's
being
used.
A
Okay,
so
what
we
can
see
here
is
I
have
a
very
simple
docker
file.
It's
using
one
of
my
images
and
we've
added
the
micro
scale.
Again,
this
executable
can
be
downloaded
from
a
github
page.
That's
it
there's
nothing
else.
That
needs
to
be
done
now
when
I
build.
Let's
take
a
look
here
so
I'm
going
to
build
this
image
and
again
you
can
run
this
on
your
laptop.
You
don't
have
to
have
anything
install.
A
A
Didn't
okay
and
this
bill
failed?
Why
did
it
fail?
Because
there
was
a
total
of
nine
vulnerabilities
in
this
image?
Three
of
them
are
critical.
You
don't
want
to
have
three
critical
vulnerabilities
in
your
kubernetes
production
environment.
Now,
that's
not
enough.
We
tell
you
for
every
vulnerability
how
to
remediate.
So,
let's
take
this
as
an
example.
So
here
is
an
NGO
next
version,
okay,
and
it
has
mvd
score
of
five.
A
We
give
you
both
the
vendor
score
and
the
MVD
score
again,
they're
not
always
the
same,
and
we
tell
you
the
fixed
version
and
the
solution.
So
we're
not
just
saying
you
have
issues
we're
telling
you.
This
is
how
you
deal
with
those
issues.
Please
go
and
remediate
this
and
then
rebuild
your
image
again.
What
this
is
doing.
It's
empowering
DevOps
from
a
security
vantage
point,
the
old
days-
and
this
my
background
is
in
security.
The
old
days
were
that
the
security
guys
controlled
the
security
in
the
IT
and
enterprise
IT.
A
Today,
the
people
that
control
this
more
and
more
actually
the
DevOps,
because
if
I,
try
and
patch
this
I'm,
not
gonna
patch
this
in
production,
my
container
is
going
to
be
dead
after
five
hours
right,
I'm
gonna
have
a
new
pod.
That
kubernetes
is
going
to
spin
up.
There's
no
persistency,
because
the
containers
are
ephemeral
by
default.
The
security
needs
to
be
baked
into
the
process
from
the
very
beginning
and
that's
what
we're
doing
with
the
micro
scanner.
The
micro
scale
is
saying:
hey
mr.
A
dev,
ops
guy,
you
have
the
power
to
control
the
security
of
your
environment.
Take
that
micro
scanner,
don't
wait
for
security,
because
then
it's
going
to
be
too
late.
If
you
do
this
in
production,
once
the
pods
are
already
running,
you
can't
SSH
into
that
container
and
upgrade
this
nginx.
You've
got
to
go
and
rebuild
the
image.
So
this
is
a
tool
that
allows
you
to
ensure
that
the
security
is
baked
in
and
automated
at
the
very
early
stages
of
that
containerized
application.
A
Just
one
more
point
around
this,
some
of
you
in
the
room
are
probably
using
some
form
of
managed
kubernetes.
Ok,
now
everything
we
spoke
about
the
admission
control
is:
there
are
certain
environments
where
you
don't
have
control
of
the
admission
controller.
You
don't
have
control
of
the
underlying
kubernetes
node
right.
So
that's
why,
from
that
point
of
view,
the
security
of
the
workload
itself
is
absolutely
crucial
and
that
this
is
a
tool
that
really
enables
you
to
do
that.
The
lights
are
dimmed.
A
A
So
yes,
the
answer
is
yes,
because
you
can
control
the
CPU
as
well
in
that
in
that
policy
yeah.
So
because
you
can
control
the
CPU
by
the
way
that
you
shouldn't
this
should
be
done
with
C
groups
or
SELinux
on
the
underlying
Linux
host
operating
system.
This
is
kind
of
an
additional
layer
to
say
that
if
that
has
not
been
done,
then
you
can
do
it
at
the
pod
level
using
the
resource
limits.
A
One
thing
I
will
we
will
say
here-
and
this
may
be
completely
self-evident,
but
the
underlying
host
operating
system-
okay,
has
to
be
completely
secure
for
a
kubernetes
node.
You
should
have
nothing
on
that
node
except
you
know
the
the
container
engine
and
maybe
SSH.
If
you
look
at
what
openshift
is
done,
you
know
they
are
an
extremely
secure
by
default,
essentially
version
of
of
kubernetes,
and
when
you
talk
to
security
people
they're
like
well,
how
do
we
scan
my
node?
How
do
I
hardened
my
node?
A
Well,
this
is
not
like
a
CentOS
box
that
has
you
know
70
processes
running
the
only
thing
running
in
that
node
should
be
the
container
engine
right
and
maybe
SSH.
It
should
be
locked
down
with
CIS
to
CIS
standards.
Ok,
and
if
that
happens,
the
attack
surface,
which
used
to
be
huge
on
that
on
a
you
know,
standard
CentOS
or
a
standard
Ubuntu
box
will
be
greatly
reduced.
Okay,.
A
A
So
so
the
free
version
of
the
microscale,
what
it
does
it
we
have
the
like
I've
mentioned
before
we
have
a
very
large
cyber
research
team
and
they
continuously
update
the
aqua
cyber
center
database.
Okay,
that
feed
gets
pushed
into
micro
scanner.
Did
that
happens
continuously?
You
don't
have
to
do
anything.
Okay,
what
happens
is
that
that
that
feed
will
get
updated.
So
every
time
you
run,
you
may
run
the
micro
scan
at
9
a.m.
A
It's
the
micro
scanner,
doesn't
check
the
cluster.
It
checks
the
image
you're
scanning
the
contents
of
your
image,
ok,
cue
bench,
which
we
mentioned-
that
checks
the
cluster
that
looks
at
the
API
server
the
nodes
and
verifies
whether
you're
compliant
with
CIS
benchmark
or
not.
Okay.
So
we've
done.
We
try
to
address
every
aspect
of
securing
the
entire
environment
from
the
workloads.
Ok,
but
then,
as
it
moves
into
production,
you
have
the
other
tools
to
use
as
well.
A
Anything
else,
thank
you.
Yes,
yes,
yeah
yeah,
but
you
push
it
out
there
soon
we're
making
changes
to
it.
Initially,
we
were
just
looking
for
the
dashboard.
We
now
added
the
ability
to
look
for
unsecured
cubelets
as
well
that
are
running
around
secure
port.
But
if
it's
not
that
today
check
in
the
next
few
days,
it
will
be
up
there
as
well.
Ok,
it's
a
Python,
it's
a
Python
tool.