BSidesSF 2018

Google’s Kubernetes has become the de facto standard for software container orchestration. As development teams have rapidly embraced it, the Kubernetes feature set has exploded and the importance of securing the Kubernetes ecosystem has come into focus. Security teams find themselves scrambling to identify potential threat vectors, establish best practices, and enable DevOps teams to accelerate without compromising their position against attackers.

To address these challenges, we've built KubeScope, a tool that leverages a combination of machine learning and rule-based detection strategies to profile orchestrator behavior. In this talk, we will demonstrate how to use this tool to secure Kubernetes deployments against new and existing exploitation vectors such as malformed input attacks targeting Kubernetes services, DDoS attacks which manipulate individual pods into flooding the orchestrator with traffic, and credential leaks. Perhaps more importantly, we will also demonstrate how our approach to detection enables us to identify adversarial behavior not only with respect to well-known exploitation patterns, but also within the context of novel attack scenarios.