# Kubernetes Podcast: Attacking and Defending Kubernetes, with Ian Coldwater **URL:** \ **Category:** General Discussions\ **Tags:** podcast\ **Created:** [August 6, 2019, 2:50pm UTC](https://discuss.kubernetes.io/t/kubernetes-podcast-attacking-and-defending-kubernetes-with-ian-coldwater/7456 "2019-08-06T14:50:14Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![k8s-bot](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/k8s-bot/32/778_2.png) [@k8s-bot](https://discuss.kubernetes.io/u/k8s-bot)\ **Post date:** [August 6, 2019, 2:50pm UTC](https://discuss.kubernetes.io/t/kubernetes-podcast-attacking-and-defending-kubernetes-with-ian-coldwater/7456/1 "2019-08-06T14:50:14Z")
[https://kubernetespodcast.com/episode/065-attacking-and-defending-kubernetes/](https://kubernetespodcast.com/episode/065-attacking-and-defending-kubernetes/) [Ian Coldwater](https://twitter.com/iancoldwater) specializes in breaking and hardening Kubernetes, containers, and cloud native infrastructure. A pre-eminent voice in the Kubernetes security community, they are currently a Lead Platform Security Engineer at Heroku. Ian joins [Adam and Craig](https://kubernetespodcast.com/about) to talk about the offensive and defensive arts. Do you have something cool to share? Some questions? Let us know: - web: [kubernetespodcast.com](https://kubernetespodcast.com) - mail: [kubernetespodcast@google.com](mailto:kubernetespodcast@google.com) - twitter: [@kubernetespod](http://twitter.com/kubernetespod) ### Chatter of the week - [Black Hat USA](https://www.blackhat.com/us-19/) - [DEFCON](https://www.defcon.org/) - [Scavenger hunts](http://defconscavhunt.com/) - [An example of Spot the Fed](https://www.vice.com/en_us/article/ypw4wb/when-the-fbi-found-out-about-def-cons-spot-the-fed-contest) - [An example of the Mystery Challenge](https://www.wired.com/2009/08/defcon-17-mystery-challenge/) ### News of the week - [Mesosphere becomes D2iQ](https://techcrunch.com/2019/08/05/mesosphere-changes-name-to-d2iq-shifts-focus-to-kubernetes-cloud-native/) - [Google Cloud launches Migrate for Anthos in Beta](https://cloud.google.com/blog/topics/hybrid-cloud/bringing-hybrid-and-multi-cloud-to-our-apac-customers-with-anthos) - [Google Cloud Game Servers coming soon](https://cloud.google.com/game-servers/) - [Episode 26: Agones, with Mark Mandel and Cyril Tovena](https://kubernetespodcast.com/episode/026-agones/) - [Announcing Kubernetes Summits in Seoul and Sydney](https://www.cncf.io/blog/2019/07/31/announcing-kubernetes-summits-seoul-and-sydney-expanding-cloud-native-engagement-across-the-globe/) - [Security updates of the week](https://groups.google.com/forum/#!topic/kubernetes-security-announce/vUtEcSEY6SM) - [CVE-2019-11247: API server allows access to custom resources via wrong scope](https://github.com/kubernetes/kubernetes/issues/80983) - [CVE-2019-11249: kubectl cp](https://github.com/kubernetes/kubernetes/issues/80984) (round 3!) - IBM and Red Hat: - [OpenShift on IBM Cloud](https://www.ibm.com/cloud/blog/red-hat-openshift-on-ibm-cloud) - [OpenShift coming to Z Series and LinuxONE](https://www.ibm.com/blogs/systems/announcing-our-direction-for-red-hat-openshift-for-ibm-z-and-linuxone/) - [Cloud Paks and services](https://www.ibm.com/blogs/services/2019/08/01/ibm-services-drives-digital-reinvention-enabled-by-hybrid-cloud-with-red-hat/) - [Cisco Container Platform now supports Microsoft AKS](https://blogs.cisco.com/news/cisco-microsoft) - [Helm deployments at the Kubedex](https://kubedex.com/helm-deployments/) - [How Kubernetes can be used for genetic analysis](https://medium.com/@Alibaba_Cloud/how-can-kubernetes-be-used-for-genetic-analysis-26167584ea77) by Mu Huan and Eric Li Alibaba Cloud - [Announcing CloudBees Jenkins X Distribution](https://www.cloudbees.com/blog/announcing-cloudbees-jenkins-x-distribution) - [Episode 44, Continuous Delivery Foundation, with Tracy Miranda](https://kubernetespodcast.com/episode/044-continuous-delivery-foundation/) - [TiDB Operator now Generally Available](https://pingcap.com/blog/database-cluster-deployment-and-management-made-easy-with-kubernetes/) ### Links from the interview - [Red teams](https://en.wikipedia.org/wiki/Red_team) and [penetration testing](https://en.wikipedia.org/wiki/Penetration_test) - [Fuzzing](https://en.wikipedia.org/wiki/Fuzzing) - [Attacking Helm’s Tiller](https://blog.ropnop.com/attacking-default-installs-of-helm-on-kubernetes/) - [Black-box](https://en.wikipedia.org/wiki/Black-box_testing#Hacking) and [white-box](https://en.wikipedia.org/wiki/White-box_testing#Hacking) testing - [DevSecOps: guard rails, not gates](https://blog.sonatype.com/less-gates-more-guardrails-devsecops-lessons-learned-in-2017) - [OWASP](https://www.owasp.org/index.php/Main_Page) - the Open Web Application Security Project - [The math behind calculating security risk](https://www.isaca.org/Journal/archives/2014/Volume-4/Pages/JOnline-An-Enhanced-Risk-Formula-for-Software-Security-Vulnerabilities.aspx) - [CVSS score](https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System) - [etcd: encrypt it at rest!](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) - [Admission control](https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/) - Technologies for isolation: - [AppArmor](https://kubernetes.io/docs/tutorials/clusters/apparmor/) - [Seccomp](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - [gVisor](https://gvisor.dev/) - [Firecracker](https://firecracker-microvm.github.io/) (not yet supported with Kubernetes) - “Kubernetes is powerful, and it’s insecure by design” - [Ian and Duffie Coolie’s BlackHat talk](https://www.blackhat.com/us-19/briefings/schedule/#the-path-less-traveled-abusing-kubernetes-defaults-17049) - [Cloud doesn’t make it better!](https://twitter.com/iancoldwater/status/1156567668838871040) - [Threat modelling](https://en.wikipedia.org/wiki/Threat_model) - [hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath) - “a powerful escape hatch” - [Trail of Bits blog](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/): understanding Docker container escapes - Recommended watching: - [Ship of Fools](https://www.youtube.com/watch?v=KR0o9WnAJMY) by Ian Coldwater ([slides](https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1541608899.pdf)) - [Hacking and Hardening Kubernetes by Example](https://www.youtube.com/watch?v=vTgQLzeBfRU) by Brad Geesaman ([slides](https://github.com/sbueringer/kubecon-slides/blob/master/slides/2017-kubecon-na/Hacking%20and%20Hardening%20Kubernetes%20Clusters%20by%20Example%20%5BI%5D%20-%20Brad%20Geesaman%2C%20Symantec%20-%20Hacking%20and%20Hardening%20Kubernetes%20By%20Example%20v2.pdf)) - [A Hackers Guide to Kubernetes and the Cloud](https://www.youtube.com/watch?v=dxKpCO2dAy8) by Rory McCune (and his [upcoming Black Hat training](https://www.blackhat.com/us-19/training/schedule/index.html#mastering-container-security-14020)) - [DIY Pen Testing for your Kubernetes Cluster](https://www.youtube.com/watch?v=fVqCAUJiIn0) by Liz Rice ([our guest on episode 19](https://kubernetespodcast.com/episode/019-kube-hunter-and-kubecon/)) - [Ian Coldwater on Twitter](https://twitter.com/iancoldwater)