Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2022, 2 Jun 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Threat Modelling Kubernetes: A Lightspeed Introduction - Lewis Denham-Parry, Control Plane

Description

Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Threat Modelling Kubernetes: A Lightspeed Introduction - Lewis Denham-Parry, Control Plane

Cloud native container and Kubernetes systems bring new threats and risks to our precious workloads. As cloud technologies undergo rapid innovation and new tools and techniques emerge, security can get left behind. The answer to this conveyor-belt of potential insecurity? Threat modelling! Join us for a primer on threat modelling cloud native systems, understanding adversarial techniques and preventative measures, and helping security and engineering teams increase the security and velocity of system delivery.

A

Hola mundo, I am louis denim paris from um control plane and I'm going to give a light, speed introduction to threat modeling kubernetes, um as I say you may know me as the head of training at control plane. However, the fact that this is a light speed talk is going to be very beneficial because I'm going to pitch to you all my crazy amazing new idea for an adventuring cloud native today, which is called very imaginatively control flame.

A

What is this well thought out? Well, considered idea, I hear you say: um control flame is all based on the fact that I run um capture the flags for a living. I love running capture the flags at cubecon for wonderful people like yourself, however, what this means is I've become very good at breaking clusters and I've forgotten everything I used to know about fixing them so control flame is my wonderful idea where I will go all over the world louis. uh What? What? What are you doing? I I I.

B

Didn't think you'd be here? No, I wasn't. I just woke up somewhere and I didn't have my lanyard. um I don't know what's really happening right now, this one. Why are you speaking why? Why are you talking about control, I'm pitching your pitch?

B

How did we get to this spot.

A

I'm so glad you asked, I thought you never would so remember, dinner last night, not really like you see this dastardly character at the back. You.

B

A

A bit suspicious yesterday, he was the man who handed your eighth glass of wine and the first to the seventh as well, and the first saturn probably explains the ditch yeah. Well, this was the start of the night. This was the end of the night.

B

ah But okay, so that's our first fright model. We can't really trust you um yes, but thank you james and so. First of all we want to talk about identity, in that some of you might not have known who I am um hi, I'm louis stenham parry. um First of all, thank you to james calagan,.

B

For the remainder of his talk, I will be james caligan, so james is a security architect at control plane. um He helped create this workshop, so this initially was a workshop that we deliver on threat, modeling, kubernetes, so hi everyone, I'm veril lewis. I don't know how to prove it to you right now, but I am the head of training at control plane.

B

So when I take a stage I like to take the opportunity to talk about mental health. um I'll just say this. For a moment I do suffer from depression, um and I know I'm not the only one who does um at times this conference has felt overwhelming um the last couple of years, having virtual conferences have had their own problems being in a room filled with people, seeing so many people all at once.

B

It's been overwhelming, but it's been so good to see familiar faces from days gone by by equally making some new ones as well. Making some new faces some new friendly faces, um but to opponent depression, if you do suffer from it, you're not alone like I'm. My dms are always open, but equally I'm sure there are so many people around you who think you're awesome um and equally. I think this is now going to be called for cubecom, where everyone found out how tall we are so like the last two years.

B

I did not know many of my colleagues and their hype. Now, if you have a caveat to this talk, is that it's always learning. I am forever learning and I'm happy with that. The terms that I'm using today are the terms that I know of um I and equally to the open source maintainers that we have in this room. If we're talking about technologies, I absolutely appreciate the time and effort that you've done you put into writing, maintaining and contributing to open source.

B

So if anything is derogative towards anything there, it is not that I'm just talking from an attacking perspective and equally saying that attacking um sometimes when given talks, some people find that too aggressive, um I'm still like trying to figure out the right, terminologies and so forth. But if I do offend you in any way, please just give me a shout out. um Just drop me. A message- and um yes, I will continue to learn but to that we're here to talk about threat modeling. So what is right?

B

Modeling threat modeling is identifying enumerating threats and vulnerabilities, it's devising mitigations and is prioritizing uh residual risks, and we want to escalate the most important things. So you should try to build the first version of a threat model without any sight, any outsider influence.

B

Then you can pull in external resources to cross-check um the group's uh thinking fret modeling can be performed at any stage of the project, but to quote the smiths: how soon is now the sooner that you get? It started the better, and this isn't a shift somewhere from a security team to someone else. This is for me, is about being a decent human being and respecting other people's informations and lives, and we'll talk more about that during this talk to that point.

B

This allows us to have diversity, which I hope, I've spelt correctly at this moment in time. Fret modeling should bring everyone together. Everyone's got a voice and everyone should be heard raise gender age all the shapes and sizes. Everyone should be at the table for this um within your organization. It should be development, it should be operations, qa, product business, stakeholders, security.

B

Equally, if you're in your own building talk to the security guards talk to the people who are cooking, the food like have you ever thought about what might happen if someone poisons a whole staff now did anyone here take part in the ctf over monday and tuesday? If you could raise a hand, I can see a couple. It's I recognize some familiar faces. Thank you ever so much for joining. Thank you for feedback. It's been.

B

That was almost a swear word. I hope. That's not a swear word in spanish now I don't think I can remember saying this and I don't really know where it came from, but my point is that I felt comfortable to share this. So you're, not you are stupid. If you assume I'll, remember you asking what you think is a stupid question.

B

I remember first time I went into a fret model I felt like I was asking the most stupid questions but, like I said, if your voice is not being heard, then that's just the stupid assumption equally back to mental health right here. So ian is in the room today, um ian smarticus and uh moet as well so skybound um they both did super awesome at the ctfs and speaking to them.

B

Like, I don't think much myself, I see the best in everyone else, and I've learned that if the people that I look up to and respect respect me, then that's something I should be proud of. So thank you to ian for doing this tweet. It gives me the motivation to stand up on stage today, so we're going to be going through these four steps. Throughout this talk, we are going to talk what about what we are building we're going to talk about what can go wrong once it's built.

B

What are we going to do about the things that can go wrong and are we doing a good, a good job it'd be good. If I could pronounce it go the first time around.

B

Are we doing a good job of analysis? If you came to kubecon and I have to present this talk, um then I have to run back to the office next week. Sorry, what I'm trying to say here is if you've come to kubecon and work has said you, you need to present something when you come back from from kubecon, because we sent you all this way. Why not do a fret model?

B

Why not do a brown bag session at lunch and bring a team around and try to figure out the risks that you might have on your projects and that's what I'm hoping to do today with this talk is to put you into a position where you feel comfortable to be able to do that.

B

So what are we building um here today? I'm I've got an assumption here that you already have an understanding of kubernetes and we're going to be focusing more about the threat modeling here, so we're going to learn more about threat modeling during this talk.

B

If you do have questions, then please come at the end and we can discuss them also I'll, be here all day tomorrow and all day tomorrow, all day tonight and I'll be here tomorrow and I'm more than happy to talk with you so documenting your system, your business is not my business, you might be a large multi-scale corporation. That's existed since what I think of as the dawn of time.

B

Equally, you might just be a startup and you might have just met your co-founder five minutes coming down on the escalator outside um coming into this talk.

B

Not all businesses are the same shape and size, so the threats are going to be different, so what type of damage can be inflicted well when we get attacked, they might be reputational damage or they might be financial loss. Now frets represent potential ways that information assets can be attacked. So let's use an information of an information asset. So is anyone in this room willing to shout out their credit card number to me now?

B

Does anyone it's so quiet?

B

So I don't think anyone wants to shout out their credit card information because it's going to be transmitted the network across here everyone's going to hear that credit card, and it's going to be there equally, I'm probably just going to write it on in a note on my phone and the storage of that isn't ideal, because it's just going to be in plain text.

B

So we got issues there about confidentiality. So we've got the cvv of the cvv digits of the credit card. We need that to stay confidential now we also have integrity, so integrity is about if someone goes to make a payment and I'm trying to say I'm gonna pay james for coming up on stage and I'm gonna give him five euro now andy the ceo of control plane he's still trying to get more money out. So then he decides that this money is going to go to his account.

B

So the integrity there is is that I think I'm doing some, I'm thinking I'm paying james, but actually it's going elsewhere. And finally, we have availability, so availability is being able to have a service available. To me to be able to process this transaction.

B

So there should be a scheme in place for how important the information is. So how much money can you lose as an organization? So as an organization if you're a startup and you're, literally counting your pennies, like you put all in to come to kubecon, to keep going for next for the next year, then maybe you're not too concerned. If it's a free service that you're offering people, then it's probably like.

B

Well, you only live once we just gotta get we gotta get through the next day, whereas if you're a multinational company, um you might be willing to lose money, it might be a lot cheaper for you just to lose money than it is to pay for a new team to fix an issue.

B

But let's also instead of talking about money for a second. Let's talk about customer data. If it is a free service, then you might be willing to say that well, I'm losing all this data, because it's a free service at the end of the day, and I'm just going to burn down this company.

B

But if you're a company, that's dealing with people's life savings and then you lose someone's information or it becomes available online, then the integrity of your business just disappears straight away and then all of a sudden, that's going to be a huge cost to you, but away from those two points, there's also something else: there's a loss of life at risk here, so we've all got personal secrets and depending on where you live, then it might be personal for a reason it might be that the political system or for religious beliefs, you can't share some of this information, but you might have reached out to someone online to be able to talk to them and feel comfortable feel part of a community if that information gets out what might happen to that person equally, if we've got personal identifiable information, as we've seen with stravacrafts previously and so forth, you might be able to identify where people are where people live and we've seen problems like that happen before so I hope I have your attention when I say to you how important it is that we deal with data and how, if someone trusts us with their data that we look after it now we've got an adversary matrix here, so these are the people who might potentially or the actors that might potentially look at attacking your system.

B

So we start off at the top on the left with a script kitty. So anyone in this room when they're at school did they ever try to play quake or doom on their school network can okay there we go as always gets the hands up. So these are people who, like watch, youtube videos and like try to figure out how to hack um and their motivation, might just be they're just trying to see what's happening, they're just trying to learn. They might also then grow into a motivated individual.

B

So this could be someone. Who's got a competing startup to you and they want to inflict damage on your business.

B

It could be someone that you've annoyed because you didn't recognize them first time around at the conference and they want to inflict damage on you or they just plain, don't like you now to that, I would like to introduce you to freddie.

B

Freddie is the nicest person I know he is phenomenal and if you give him a follow those two things they do so well online and they do this on capture capture, flag events, you'll see them hacking away on youtube and so forth. Follow freddy and then you're going to learn more about the techniques that most people might use so from there we're going to look towards insiders. So this is someone inside um your organization. So instead of having someone who's outs outside of your organization, I'm frustrated with you. They somehow find them their way inside.

B

So this could be a disgruntled employee. They might have just seen a spreadsheet with people's salaries and then they've seen that they've they're earning say 40 less than everyone else, and they want to take out on the business now we'll come back to this in a little bit again, but then that also leads on to organized crime. So an organized crime. You can think of this as a business, because they're just trying to exfiltrate money and they're going to go for key individuals.

B

So, and this comes back to covid for the last two years- we've been sharing lots of personal information online and, depending on our threat model, how open we've been about it, but it's a way for us to find our communities again when we've been locked away from each other.

B

Can these opportunities allow people to identify people that might be in an organization that they can look to leverage and right now? This moment you might like, you might think to yourself, I'm so happy my job. I've got a perfect job in the world and everything is rosy.

B

But what happens when say a family member gets a medical bill and they can't cover it and they come to you asking and they there's this huge bill and then you've got to find that money overnight. If someone comes waving, this money towards you just to give them some credentials some access to this, something as simple as that.

B

Would you be willing to give them access to that? And could that be someone else? Next to you and again, I know this sounds like far-fetched, but I was trying to figure out just a moment ago. I think I've lived through two or three recessions. Now, possibly four soon um I've lived through a pandemic. I've lived through a volcano erupting that blocked air travel and I've lived through a leicester city.

B

Winning the premiership tell me that ten years ago, and I would have just said no way, but that's where we are now to get some user involvement. um I've devised some games today, so the first game I've got is called the apprentice so prior to you all. Coming in today, um underneath the seats I've put two post-it notes, so someone's got a post-it note with game: zero, zero written on it. So if you look underneath your seats and I'm hoping you're sat on one of the seats that has a post-it note.

B

We got one over there all.

A

B

So would you mind just reading? What's on your post-it note,.

B

Yep, so just for people who might be watching online, um if I just make sure I get it right, you're, a c-level, exec and someone's emailed you, your password and they've, said that they've got a webcam video of you from your laptop, so all of a sudden, you're, probably now thinking well, I don't want that video to be online so that someone's got leverage over you at this moment in time.

B

So that's an example as to what can happen in an organization think of linkedin as an attacker. I can just search for c-level execs of these business, so I can have like. I can look into your company's documents. I can see how much you're trading I can target you that way.

B

At this point, not everyone's tacky educate your team. I think we've all seen those emails before that show us that password we're all here, probably nodding saying well, yes, I know about. Have I been pwned, I know straight away that that was from a data breach from someone a while ago, but if you're a c-level exec you don't and equally they're targeting the emotions there so again educate your staff. Make sure that they're, aware of it and look towards password managers as well so to go back to this?

B

We've got our cloud cloud service insider, so we're building up on dependencies now as well. So when we looked inside our organization and the people around us, what about the people that we're dependent on so you're running kubernetes? So I'm pretty I'm presuming that a lot of you are running stuff in the cloud. The cloud is real. So, even though we talk about it being rented to compute, you can go and touch a compute somewhere in this world and that's where your workloads are running. Do you trust an individual who's got access to?

B

That is your organization, a bank where you need to know that someone can't touch that server unless they've got a certain clearance and the reason why we need to do that is for the next one. So I don't think you need to do this again, but there was another post-it note in this room, and so, if you had the other post-it note, would you mind standing up cool we've got one over here. So would you mind just sharing what yours says.

B

It's a pleasure to meet you so so um they just mentioned that they work, uh so they are part of a government agency with unlimited funds towards offensive security. Oh this was part of the game. Sorry, who's sat next to me anyway, um but so that government could even create a new identity for you. So when you go to get your job, when they go to get the job, they could create a brand new identity.

B

They can make that person look as they want to and with the unlimited funds that they have there, then it's all of a sudden. It's a different kind of thread.

B

So here's an example of a section of a data flow diagram that we used in our full workshop. A data flow diagram should describe the complete set of data. It should show our trust. Boundaries should show all user roles, all network interfaces, and we should make this self-contained and the most important thing out of all those things is that we make it accurate.

B

If it's not accurate, then it's worthless to make us easier for others to consume and contribute towards. We can have a high level overview again. We want to bring as many people as possible to this and um remember. Well, we can then delve deeper into this.

B

We can deeper levels going into favor abstractions, but at this point just remember to drop a ladder, an assumption that you make because it's something that you've done for the last five years, the per the junior or someone else or whoever it may be, doesn't even have to be a junior someone who's coming on. Who doesn't have that knowledge that you do? They need to be able to pick this up and understand what's happening.

B

So this is an example of the cncf financial services user group of a kubernetes data flow diagram, so we've identified state flow with the black lines in this, the black arrows are crossing the machine segregation between nodes, as seen with the green boundaries, there's a lot of information here. But if you want to learn more about it, then we've got access to the cncf repo. There.

B

So how can attacker look for an entry point um publicly available? Information is the easiest route in so rory is someone again who I have the utmost respect for in the industry, and I look towards for this, and so they've got a fantastic blog post um about finding publicly accessible clusters and you might think to yourself. Well, I've been running classes for so long now. Why would someone make it publicly accessible well from the keynotes we've heard about how many new people are still coming into kubernetes?

B

This is day one for cuban, if someone's starting up their journey again- and I can attest that I learned by making mistakes, and so other people will potentially be making these mistakes, and this is why we need a threat model. We need to understand what we're making available.

B

So what can go wrong and with the alignment of this header, we can see a great example of things that can go wrong. This is where your experience is required. Has anyone ever heard of a term secret source that is used with your products?

B

Now the secret source is something that isn't if it isn't very secret anymore. Is that going to cause you issues? We can also use threat. Intelligence sources such as these to help and guide us, and lots of lots of people have collated information to help us with this. As with everything cloud native, we stand on the shoulders of giants and we really appreciate that, and these techniques give us a starting point from there. We can use modeling techniques such as stride and attack trees, to go into further detail now.

B

To give an example, um we're going to use the microsoft threat matrix for kubernetes now, I'm not going to go through each of these, but the highlight that I'd like to make you aware of is the red and the green, so the red shows deprecated techniques and the green show news techniques now the reason I'm saying this is because kubernetes is constantly evolving. We've seen the four month release sketch schedule for it. This is ever-changing, so if that's evolving, we need to evolve our threat models with it too stride.

B

Now I can never remember the acronym for strike, but um for each um we need to strive for process for data flow um for still and for actor, and we need to identify what might go wrong so with stride um strike, um spoofing pretending to be something or someone who you're not so james. Did this perfectly at the start of his talk by pretending to be me tampering so back to the banking example. um When we talked about, um I was trying to pay james five euros. Andy took that request.

B

He modified it so that andy paid five euros. That's tampering in action repudiation, so this is when we just assume business is happening as usual. If andy did that in transit, then I would not necessarily be aware that andy has changed. um The bank account I'm assuming I've paid james, so if james hasn't been paid. How do I know that andy's taking the money and equally, if I say to andy andy, you took my five euros: how how can he you'd say? No? No! No! I haven't. How can I prove it? Oh, hey andy.

B

Right and so we got I for information disclosure, um this is exposing information of people who aren't authorized to see it. So this was the example of a credit card. Cvv information, no one's willing in this room to give me their credit card number. So I think you need to trust that if you're taking anyone's credit card number, I think you should treat them the same so d for denial of service.

B

um At this point it feels like I'm, probably ddossing you with the amount of information I'm giving you, but if you've got a perfectly accessible api, then someone could ddos that account and take your say, the api offline. So then, the administrator of a cluster can no longer manage their workloads.

B

Then we've got elevation of privilege and james again did this perfectly. He went from having a speaker lanyard to having a sorry sponsor lanyard to a speaker, lanyard, and then he was able to get get up on stage and tell you what he wanted to say.

B

So we build from strider and we visualize with attack trees. This helps to identify risks to our resources and the likelihood of them happening. We don't want to have too much information in this instance, so please focus on the quality and not the quantity at this stage and be confident to deliver concise documentation.

B

Now, in this example, we use a delivery person who has taken a sensitive document from building a to building b, to be stored in a locker. So to compare this kubernetes people would be equal to our workloads. Our roads is equal to networking, buildings would be equal to storage and our security guards are equal to the control plane. So you can see from a color coding here at the top.

B

Our top node is an an ornot and we also have an and node so for the example of that the blue and node reads steal from locker, so the and node means that the two children nodes of yan node need to be accomplished to be able to access. So this needs to be both the child nodes. So the key to vlogger and entry to the building.

B

Now now caddy shortridge has uh shown us how to use graphville's graphic vis. Sorry to build attack. Trees deciduous is another option available to code in a tactory, and we have also created an example available in our git repo listed here.

B

These slides will be available afterwards.

B

So let's have a look at what can go wrong within kubernetes, so this is our game game, 02, wheel of misfortune, so I've kindly asked james manley if he would mind playing wheel of misfortune so james have you ever played wheel of 14 before of misfortune?

B

You have not okay. So could you give me a letter? Please is no v. Can you give me another letter, please that is not v?

B

Okay, so we got r.

B

B

All a, I think, it's the point: can anyone guess what this uh cumulative? uh What could go wrong with kubernetes here? Does anyone have a clue fadden, our back yeah, our back misconfiguration misconfigurat.

B

So this was a great idea that happened a couple of hours ago and we invested a lot of time and effort into getting to this stage. If you've ever tried to create this, oh geez, so um we had to make a quick decision. Did we continue with this? Or do we scrap it? So we fixed it and we've um added configuration onto it.

B

So what can go wrong with kubernetes? Well, we've got workloads so versus our parts. We could have a rice within there. We could have a reverse code executable in there. It could be a container breakout. So if you did the ctf on monday, we showed you how to break out of a privileged container. It could be file systems, host, mounts hostile containers run times, pod configuration pod security contacts and service accounts and there's networking. So we got intro upon that intra pod network.

B

So it's past communicating with each other so sitting in a control plane being able to communicate with something in a default and vice versa into part. So we've got our own network within the pod. So what about the containers within the same pod?

B

We don't have any workload identity by default and we don't have network policy by default, so storage. What about attacking volumes? We have the dangers of the host mounts again shown in the ctf and equally, what happens if we have no encryption at rest. So if we're perceiving that, where we're storing our state, what happens if scd isn't encrypted? What happens if um our persistent storage isn't encrypted and then also with our iam policies? So can we pivot to attack on the cloud apis?

B

Can we pivot to attack the kubernetes api and can we exploit app workflows?

B

So, in summary, what can go wrong lots, and this is overwhelming. I understand that, but the most important thing that you can do is just try. You start with you, put your best foot forward and you keep pushing forward now. This is only a small subsection of the attack tree and we can review these attacks to show to see how they will be scoped.

B

Do our attackers have access to the resources that can enable them and this equally, this? um This is available on the threat, modeling labs, repo as well.

B

So what are we going to do about it? Absolutely nothing!

B

We can do absolutely nothing about it and that's what's going to happen if you're not doing threat modeling, because you're not aware of this equally, when you do become aware of it, then you might say: well, we don't need to do anything about it, but it's important to become aware of the risks, and then you determine that with your own threat model.

B

Now we have all performed our own personal threat model and kubernetes in kubernetes. That's not our company name, we're control plane, which is equally difficult when you work with kubernetes in our company control plane, we've been discussing about our um personal threat model during covid, because everyone's been affected differently, for whatever reason we all have to make different choices.

B

We've all decided to come out to valencia and come to this and there's people who are at home, maybe watching this, who might have decided not to in doing all that you had to make you identified the risks and you identified if it was worth you coming. So when we talk about threat, modeling, don't think of it as a scary, buzzword now, with shared responsibility model um equally, depending on where we run our kubernetes cluster.

B

If we are running it in the cloud and we're using a hosted service and they're managing our control plane for us, then maybe we don't. We don't have to worry about the control plane, that's being managed as someone else to handle, whereas if you, uh if you're running your own kubernetes, um then you do need to then consider about uh managing the security of your control plane, so risk management.

B

So if in in the case of a voyage, just think of a marie condo and if it doesn't bring you any joy whatsoever just throw away like just get rid of it. If you want to avoid it now, if it is bringing you joy, if you do require to run it, then we can mitigate this. But that means that you need to make it better and you make it better until it brings you to a position where it brings, you joy, you can accept it, which is just to do nothing.

B

It's myth you and that's fine. This is your risk. This is your decision or you can transfer this, so you could just pass it to legal or to your insurers, and then you can give them joy and doing whatever it is that they do now. um We can do things we can be preventative, so um preventative is about shifting our knowledge. Now we talk about shift left.

B

If you've got developers who are just committing some yamlin or some infrastructure people, we can use tools like cubesat or oper, and then with these tools. We can then review our workloads as a mission controller, but not just deny not just to say you can't run this workload. Help educate people at this stage help give them a reason as to why they shouldn't be doing this, because if they can understand why they shouldn't be doing it. That now gives you growth. That gives you growth within your business.

B

So we can be a detective, so we can export and monitor logs. So tools like psyllium and falco are great at doing this corrective. So if we can have a corrective approach, so this could just be a big red button on your desk. If something doesn't feel right, if you want to cut everything out, you can literally just pull the plug out of it and hit this button. That gives you the confidence to do it, and this is a shout out to old school as well.

B

Now in training with kubernetes, I see there's lots of patterns that get repeated over and over again, but equally, I see patterns that die off and are no longer available, so to ensure that you base your decisions on technologies and concepts that we still use today, don't necessarily use the old ones instead, kubernetes and cloud im is at the center of cloud native security, so review review your permissions regularly and user management processes are key, so review, onboarding, off-boarding processes, so joiners movers and levers or jml implement strong access controls and policies default.

B

Kubernetes service accounts should not be used, create a dedicated service account for every workload. Is your workload, identity and workloads will interact with kubernetes api over cloud via workload, identity, integration, cloud provider, cloud provider services can help so im rolls for service accounts in aws or workload identity in gke.

B

The irsa uses service account token volume projections, and this is one benefit of using a managed offering for cryptographically strong workload. Identities, spy can be used and spy is a production, ready implementation of spiffy's apis.

B

So look towards the least privileged parts, always look at least privilege. Make sure that you can't run things that you don't want to be able to in within your pods review what the workloads are when they're being submitted and use ids to report suspicious behavior, where possible and use automated security testing within your pipelines.

B

So I don't know if anyone else has spoken about supply chain at cubecon right yet so to save a bit of time. This is my hot take. I would I would employ at six store. It is luke hines um I've had the pleasure of chatting to luke.

B

He is such a good person and I'm so excited to see what happens like some other future halls with six store and I'm sure it's gonna be awesome um equally as a vet to that there is uh jed and adrian at chain guard and I'm expecting to see amazing things with as well for sure. So please look towards those talks around this conference in regards to networking um go chats and italia.

B

I surveillant and we've been working together on the ctf and the tools that they're open sourcing this week are phenomenal and really exciting to look at, but with this as well um on day, one look towards network policies and such make sure that um only things can communicate to each other that you want to be able to communicate to each other, so manage your secrets with whatever works, for you. Don't just go for a big name, just whatever you feel comfortable with.

B

Whatever is right, for you make sure it's just implemented correctly, um use a mission control to cut to have context as to what's being shared, and no one should be able to read. uh What's in my volume and no one should be able to I get, I was in my volume, so we have controls for the security requirements and I'm giving this talk a moment and you're living in real life. Everything that I'm probably saying is, you might just say to you: well that's great you're on stage just talking about this.

B

I understand our businesses make decisions which sometimes we don't understand ourselves, and we have to work with that. But again, like I said, we're all human beings. We just need to do the best job that we can with what we're given prioritize the risk and do what you can do so did we do a good job?

B

um I've heard this possibly several times in my career now that I've done a good job, but it's important to make sure that we're confident that we've achieved what we've set out to do and look towards other people as well to help you identify this. So it's important to look back as well as looking forward. Have we achieved what we have set out to do? Look to others for their reviews. Is this something that you've missed out?

B

There's, testing testing and testing and we'll talk about testing with security in a moment and as time moves on our acceptable level may change. So what I mean by that is document the decisions that you make today. The decisions that you make today is with the information that you have available to you right now. If someone reviews that in a week's time, then the information that they're using to make that decision is different.

B

So if you document exactly the reasons why you've done this, it gives a fighting chance in the future to understand why we've implemented things and select security controls for implementation, so map these controls to our attack trees. So when we've identified in our attack tree a possible route, then we look at the controls that can mitigate this. For us, this provides us a direct means of evaluating our effectiveness.

B

Visual representations are easier to reason about so identify how many nodes and branches of your attack tree are covered by mitigating these controls. This assesses the resulting security of a system so enough security controls are defined. Any new attacks added to the tree should be mitigated by existing controls.

B

So if you look within the gate, repo that we have um you'll find an example of us using gas to test our security security requirement of a cluster.

B

So in this um we did a demonstration of a part security policy, and so, as we change the version of our kubernetes cluster and part security policies are no longer in place. Our control is no longer there for our security requirement, so our test fails when we upgrade our cluster, but that's great for us, because that tells us that our security requirement is no longer controlled and that when we have that failed test, we know we need to review that.

B

It equally allows your team to develop to deliver and contribute code with confidence.

B

So I got this far into the talk without talking about wales, I'm very proud of where I've come from and I feel you should be proud of where you've come from too and when I grew up. I couldn't really identify with anyone, and I didn't know where I was going in my life um so being able to be a bit like confident in myself. I tried to leave a way forward so that others can follow if they still wish. Now we also have castles in wales.

B

Now castles are the ogs of threat modeling in my mind, if you ever feel like you have to walk around a castle, just think of all the ideas that they had to prevent people attacking.

B

But at this point um I thought there was a song by welsh band, which is a good way to leave this talk. So there's a band called the stereophonics with a song called a thousand trees with a link to it there, but I've changed it to. It only takes one project to identify a thousand frets and it only takes one fret to burn a thousand projects and finally, um just remember your own voice.

B

I've been trying to say today that your voice is so important that you share and you share these ideas that you have today well this morning visit twitter fred. So has anyone had issues with taxis in valencia?

B

Has anyone been in a taxi in valencia? Okay, has anyone been in the taxi on a roundabout in valencia? Why not exactly so? It's a bit worrying, but I mentioned on the first day I got here. I just started talking to my taxi driver and I became friends with my taxi driver and we shared numbers, and so every morning at 8 am my taxi driver and I he picks me up and I'm getting as much swag for his children. We had to facetime with my daughter on the way in this morning.

B

It was um probably too much information, but to that rory, who I mentioned earlier on, who I absolutely I look towards um rory replied with now that that is good thinking. So that's an example today, where something that I just thought was so obvious to do is for other people. You might not necessarily see so I hope you can leave here without feeling that we can all contribute and please feel free to empower others around you as well. So to that, I thank you for your time. Enjoy your kubecon and enjoy.

B