This talk gives an overview of the security issues reported to the Kubernetes project in the last year, as well as of the overall security improvements introduced in Kubernetes (especially around service account tokens and NodeRestriction). Two main take away points: PodSecurityPolicies might never make it to GA (!!), and misconfiguration remains the primary pain-point and source of compromise.

These are the slides of the talk Maya Kaczorowski delivered at Kubecon. The talk starts by covering the main Kubernetes components that need trusted communication, and how this communication is protected. Then, it goes over how the cluster certificate authority (CA) works, and how this grants certificates to Kubernetes components. Lastly, it explains how you can protect other communications within your cluster, if needed for your workload - like node to node and pod to pod.

This post from Evan analyses the change introduced this past week by AWS around "session-based requests", in order to mitigate the risk of SSRF in the EC2 metadata service. They refer to the new offering as IMDSv2, with the previous offering used by Capital One being IMDSv1. In the end, requiring HTTP PUT prevents GET based attacks (like webhooks) but this is not a complete solution to SSRF problems.

The Cloud Native Security Hub aims to be a platform for discovering and sharing rules and configurations for all cloud native security tools. The first version just released introduces Falco rules support, but support for other tools will come soon. On the plus side, all the source code for the Hub is available under Apache 2.0 license, under the falcosecurity Github organisation.

Sysdig Secure 3.0 introduced native prevention and incident response for Kubernetes, with three main features: Kubernetes Policy Advisor prevents threats at runtime using Kubernetes Pod Security Policies, Falco Tuning optimises Falco rules to reduce false positives and alert fatigue, and Activity Audit speeds incident response and enables audit by correlating container and Kubernetes activity.

The Duo Labs team released parliament, an AWS IAM policy linter. This tool helps avoid IAM policy errors that can have significant impact to both security and functionality.

kubepox, which stands for "Kubernetes network Policy eXploration tool", is a tool that allows to query all the network policies defined in the cluster, together with the affected Pods.

Nice writeup (with exploitation) of CVE-2019-14271, an issue in the implementation of the Docker cp command that can lead to full container escape.

This post goes super in-depth about the design thinking behind gVisor and container sandboxes.

AWS released v2 of the EC2 Instance Metadata Service (IMDSv2). With IMDSv2, every request is now protected by session authentication. IMDSv2’s combination of beginning a session with a PUT request, and then requiring the secret session token in other requests, is always strictly more effective than requiring only a static header. AWS analysis of real-world vulnerabilities found that this combination protects against the vast majority of SSRF vulnerabilities. But there is a caveat, both IMDSv1 and IMDSv2 will be available and enabled by default, and customers can choose which they will use.

The IAM API now provides information about when a role has last been used to make an AWS request. In this post, AWS demonstrates how you can identify inactive roles using role last used information. Additionally, they show how to implement continuous monitoring of role activity using AWS Config.

You can now reference Organizational Units (OUs), which are groups of AWS accounts in AWS Organizations, in AWS Identity and Access Management (IAM) policies, making it easier to define access for your IAM principals (users and roles) to the AWS resources in your organization. AWS Organizations lets you organize your accounts into OUs to align them with your business or security purposes. Now, you can use a new condition key, aws:PrincipalOrgPaths, in your policies to allow or deny access based on a principal’s membership in an OU. This makes it easier than ever to share resources between accounts you own in your AWS environments.

Google updated their GKE hardening guide with new security features and a new section "Secure Defaults". The goal: move as many items to secure defaults as possible.