Search icon Close icon
Search icon
Subscription
0
Cart icon
Close icon
You have no products in your basket yet
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
Learn Kubernetes Security

You're reading from  Learn Kubernetes Security

Product type Book
Published in Jul 2020
Publisher Packt
ISBN-13 9781839216503
Pages 330 pages
Edition 1st Edition
Languages
Concepts
Authors (2):
Kaizhe Huang Kaizhe Huang
Profile icon Kaizhe Huang
LinkedIn
Kaizhe Huang is a security researcher at Sysdig, where he researches how to defend Kubernetes and containers from attacks ranging from web attacks to kernel attacks. Kaizhe is one of the maintainers of Falco, an incubation-level CNCF project, and the original author of multiple open source projects, such as kube-psp-advisor. Before joining Sysdig, as an employee at Stackrox, Kaizhe helped build a detection data pipeline, conducted security research, and innovated detection based on machine learning. Previously, as a senior security engineer at Oracle, he helped build security products: Database Vault, Database Privilege Analyzer, and Database Assessment Tool. Kaizhe holds an MS degree in information security from Carnegie Mellon University.
See other products by Kaizhe Huang
Pranjal Jumde Pranjal Jumde
Profile icon Pranjal Jumde
LinkedIn
Pranjal Jumde is a senior security engineer at Brave Inc. In the security industry, he has worked on different aspects of security, such as browser security, OS/kernel security, DevSecOps, web application security, reverse engineering malware, security automation, and the development of security/privacy features. Before joining Brave, as an employee at Stackrox, Pranjal helped in the development of detection and enforcement features for the runtime detection platform. He has also worked at Apple and Adobe, where he worked on the development of features to harden various platforms. Pranjal holds an MS degree in information security from Carnegie Mellon University. He has also presented his research at different conferences, such as ACM CCS and BSides SF/Delhi.
See other products by Pranjal Jumde
View More author details

Table of Contents (19) Chapters

Preface 1. Section 1: Introduction to Kubernetes
2. Chapter 1: Kubernetes Architecture 3. Chapter 2: Kubernetes Networking 4. Chapter 3: Threat Modeling 5. Chapter 4: Applying the Principle of Least Privilege in Kubernetes 6. Chapter 5: Configuring Kubernetes Security Boundaries 7. Section 2: Securing Kubernetes Deployments and Clusters
8. Chapter 6: Securing Cluster Components 9. Chapter 7: Authentication, Authorization, and Admission Control 10. Chapter 8: Securing Kubernetes Pods 11. Chapter 9: Image Scanning in DevOps Pipelines 12. Chapter 10: Real-Time Monitoring and Resource Management of a Kubernetes Cluster 13. Chapter 11: Defense in Depth 14. Section 3: Learning from Mistakes and Pitfalls
15. Chapter 12: Analyzing and Detecting Crypto-Mining Attacks 16. Chapter 13: Learning from Kubernetes CVEs 17. Assessments 18. Other Books You May Enjoy

Summary

In this chapter, we covered how to harden a container image with CIS Docker benchmarks, and then we gave a detailed introduction to the security attributes of Kubernetes workloads. Next, we looked at the PodSecurityPolicy in detail and introduced the kube-psp-advisor open source tool, which facilitates the establishment of pod security policies.

Securing Kubernetes workloads is not a one-shot thing. Security controls need to be applied from the build, deployment, and runtime stages. It starts with hardening container images, and then configuring security attributes of Kubernetes workloads in a secure way. This happens at the build stage. It is also important to build adaptive pod security policies for different Kubernetes workloads. The goal is to restrict most of the workloads to run with limited privileges, while allowing only a few workloads to run with extra privileges, and without breaking workload availability. This happens at the runtime stage. kube-psp-advisor is...

lock icon The rest of the chapter is locked
arrow left Previous Chapter
Chapter 1 of 19
Next Chapter arrow right
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Sign up now
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Start free trial
Renews at $15.99/month. Cancel anytime}

Authors (2)

Left arrow icon
Profile icon Kaizhe Huang
LinkedIn
Kaizhe Huang is a security researcher at Sysdig, where he researches how to defend Kubernetes and containers from attacks ranging from web attacks to kernel attacks. Kaizhe is one of the maintainers of Falco, an incubation-level CNCF project, and the original author of multiple open source projects, such as kube-psp-advisor. Before joining Sysdig, as an employee at Stackrox, Kaizhe helped build a detection data pipeline, conducted security research, and innovated detection based on machine learning. Previously, as a senior security engineer at Oracle, he helped build security products: Database Vault, Database Privilege Analyzer, and Database Assessment Tool. Kaizhe holds an MS degree in information security from Carnegie Mellon University.
Read more
See other products by Kaizhe Huang
Profile icon Pranjal Jumde
LinkedIn
Pranjal Jumde is a senior security engineer at Brave Inc. In the security industry, he has worked on different aspects of security, such as browser security, OS/kernel security, DevSecOps, web application security, reverse engineering malware, security automation, and the development of security/privacy features. Before joining Brave, as an employee at Stackrox, Pranjal helped in the development of detection and enforcement features for the runtime detection platform. He has also worked at Apple and Adobe, where he worked on the development of features to harden various platforms. Pranjal holds an MS degree in information security from Carnegie Mellon University. He has also presented his research at different conferences, such as ACM CCS and BSides SF/Delhi.
Read more
See other products by Pranjal Jumde
Right arrow icon

Other recommended products

Related to this chapter
Left arrow icon
Kubernetes - A Complete DevOps Cookbook
Kubernetes - A Complete DevOps Cookbook
Kubernetes is one of the most popular, sophisticated, and fast-evolving container orchestrators. In this book, you’ll learn the essentials and find out about the advanced administration and orchestration techniques in Kubernetes. Readers will also learn to manage containers using the latest version of Kubernetes with a recipe-based approach.
Mar 2020 19 hours 28 minutes
The DevOps 2.3 Toolkit
The DevOps 2.3 Toolkit
Viktor Farcic’s latest book, The DevOps 2.3 Toolkit: Kubernetes, will take you on a hands-on journey with Viktor into the world of Kubernetes, and the tools not only behind the official project but also the wide-range of third-party apps that are available for you to use.
Sep 2018 13 hours 56 minutes
Cloud Native with Kubernetes
Cloud Native with Kubernetes
Cloud Native with Kubernetes will guide you effectively - from your first steps using Kubernetes right up to running enterprise-grade cloud native applications with best practices. The book covers every aspect of deploying, securing, and operating modern cloud native applications on Kubernetes.
Jan 2021 14 hours 52 minutes
Kubernetes Cookbook
Kubernetes Cookbook
Kubernetes is one of the most popular, sophisticated, and fast-evolving container orchestrators. In this book, you’ll learn the essentials and find out about the advanced administration in Kubernetes. We’ll take you through a step-by-step hands-on approach, which will familiarize you with the Kubernetes ecosystem.
May 2018 18 hours 28 minutes
The Kubernetes Workshop
The Kubernetes Workshop
This workshop takes you through a Kubernetes-oriented application delivery pipeline in a practical way. You’ll learn how to manage containers efficiently and scale and stabilize cloud-native applications using Kubernetes.
Sep 2020 26 hours 0 minutes
Kubernetes and Docker - An Enterprise Guide
Kubernetes and Docker - An Enterprise Guide
Complete with practical examples and explanations to address running Kubernetes in an enterprise, this book guides you to integrating Kubernetes clusters with load-balancers, external name resolution for services, OIDC using an enterprise directory, Kubernetes impersonation, security using PSPs and OPA, advanced auditing and reporting, backing up workloads, and provisioning a platform.
Nov 2020 17 hours 32 minutes
DevOps with Kubernetes
DevOps with Kubernetes
Kubernetes is a reliable container orchestration framework. It makes things easier - building load testing websites, creating a staging environment or moving business online to production. With Kubernetes, the speed of development, testing, and deployment can be improved and accelerated. Upon completion of this book, you’ll learn not only handy DevOps skills including containerization, monitoring, logging and continuous delivery but also Kubernetes deployment and administration on popular public clouds.
Oct 2017 12 hours 44 minutes
The Kubernetes Book
The Kubernetes Book
This easy-to-read book is your one-stop solution to learning all the important and fundamental parts of Kubernetes. You’ll learn how to develop your applications with Kubernetes, deploy to your chosen cloud platform, migrate to a different cloud platform, and even migrate to your private cloud at your on-premises datacenter.
Jun 2019 7 hours 36 minutes
Docker Certified Associate (DCA): Exam Guide
Docker Certified Associate (DCA): Exam Guide
With the rise of containerization, skills in containers especially Docker have higher market value. Docker Certified Associate (DCA) is the official exam designed to validate that skillset with real-world questions. This book will cover all topics required to successfully pass the Docker Certified Associate exam.
Sep 2020 20 hours 24 minutes
Introduction to DevOps with Kubernetes
Introduction to DevOps with Kubernetes
Introduction to DevOps with Kubernetes addresses the widespread problems faced by developers who are starting out with DevOps using Kubernetes. You’ll build out example portfolio pieces and tackle intellectually stimulating challenges that will help prepare you for technical screenings and complex software lifecycle problems.
May 2019 12 hours 28 minutes
DevOps with Kubernetes
DevOps with Kubernetes
This book will guide you from container basic concepts to orchestrating containerized applications in Kubernetes. You’ll learn about the Kubernetes basic architecture, components, resources, admission control, and extensions. We’ll show you how to utilize Kubernetes services in three top cloud providers.
Jan 2019 16 hours 8 minutes
Kubernetes Design Patterns and Extensions
Kubernetes Design Patterns and Extensions
Kubernetes is an open source platform that automates scaling, deployment, and management of container-based applications. The book starts by explaining basics about container orchestration and then moves on to explain how the components of a complex system, such as Kubernetes, interact with each other and helps develop vital skills for troubleshooting Kubernetes clusters and applications running in Kubernetes clusters. Once you are done reading the book, you can easily develop and deploy your own applications with Kubernetes in no time.
Sep 2018 3 hours 32 minutes
Right arrow icon

Personalised recommendations for you

Based on your interests and search pattern
Left arrow icon
Attacking and Exploiting Modern Web Applications
Attacking and Exploiting Modern Web Applications
Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.
Aug 2023 11 hours 16 minutes
Automotive Cybersecurity Engineering Handbook
Automotive Cybersecurity Engineering Handbook
This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.
Oct 2023 13 hours 4 minutes
Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide
Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide
This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.
Aug 2023 16 hours 32 minutes
Cloud Penetration Testing for Red Teamers
Cloud Penetration Testing for Red Teamers
The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.
Nov 2023 9 hours 56 minutes
ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide
ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide
ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.
Sep 2023 10 hours 32 minutes
Burp Suite Cookbook
Burp Suite Cookbook
Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.
Oct 2023 15 hours 0 minutes
Building and Automating Penetration Testing Labs in the Cloud
Building and Automating Penetration Testing Labs in the Cloud
This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.
Oct 2023 18 hours 44 minutes
Ethical Hacking Workshop
Ethical Hacking Workshop
As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.
Oct 2023 7 hours 20 minutes
Windows Forensics Analyst Field Guide
Windows Forensics Analyst Field Guide
This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.
Oct 2023 10 hours 36 minutes
Implementing DevSecOps Practices
Implementing DevSecOps Practices
This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.
Dec 2023 8 hours 36 minutes
Right arrow icon