Security
Reader small image

You're reading from  Learn Kubernetes Security

Product typeBook
Published inJul 2020
PublisherPackt
ISBN-139781839216503
Edition1st Edition
Tools
Kubernetes
Concepts
Cloud Security
Right arrow
Authors (2):
Kaizhe Huang
Kaizhe Huang
author image
Kaizhe Huang

Kaizhe Huang is a security researcher at Sysdig, where he researches how to defend Kubernetes and containers from attacks ranging from web attacks to kernel attacks. Kaizhe is one of the maintainers of Falco, an incubation-level CNCF project, and the original author of multiple open source projects, such as kube-psp-advisor. Before joining Sysdig, as an employee at Stackrox, Kaizhe helped build a detection data pipeline, conducted security research, and innovated detection based on machine learning. Previously, as a senior security engineer at Oracle, he helped build security products: Database Vault, Database Privilege Analyzer, and Database Assessment Tool. Kaizhe holds an MS degree in information security from Carnegie Mellon University.
Read more about Kaizhe Huang

Pranjal Jumde
Pranjal Jumde
author image
Pranjal Jumde

Pranjal Jumde is a senior security engineer at Brave Inc. In the security industry, he has worked on different aspects of security, such as browser security, OS/kernel security, DevSecOps, web application security, reverse engineering malware, security automation, and the development of security/privacy features. Before joining Brave, as an employee at Stackrox, Pranjal helped in the development of detection and enforcement features for the runtime detection platform. He has also worked at Apple and Adobe, where he worked on the development of features to harden various platforms. Pranjal holds an MS degree in information security from Carnegie Mellon University. He has also presented his research at different conferences, such as ACM CCS and BSides SF/Delhi.
Read more about Pranjal Jumde

View More author details
Right arrow

Security boundaries in the system layer

Microservices run inside Pods, where Pods are scheduled to run on worker nodes in a cluster. In the previous chapters, we already emphasized that a container is a process assigned with dedicated Linux namespaces. A container or Pod consumes all the necessary resources provided from the worker node. So, it is important to understand the security boundaries from the system's perspective and how to fortify it. In this section, we will talk about the security boundaries built upon Linux namespaces and Linux capabilities together for microservices.

Linux namespaces as security boundaries

Linux namespaces are a feature of the Linux kernel to partition resources for isolation purposes. With namespaces assigned, a set of processes sees one set of resources while another set of processes sees another set of resources. We've already introduced Linux namespaces in Chapter 2, Kubernetes Networking. By default, each Pod has its own network...

lock icon
The rest of the page is locked
Previous Page
Chapter 7 of 19, Page 6
Next Page
You have been reading a chapter from
Learn Kubernetes Security
Published in: Jul 2020Publisher: PacktISBN-13: 9781839216503
© 2020 Packt Publishing Limited All Rights Reserved

Authors (2)

author image
Kaizhe Huang

Kaizhe Huang is a security researcher at Sysdig, where he researches how to defend Kubernetes and containers from attacks ranging from web attacks to kernel attacks. Kaizhe is one of the maintainers of Falco, an incubation-level CNCF project, and the original author of multiple open source projects, such as kube-psp-advisor. Before joining Sysdig, as an employee at Stackrox, Kaizhe helped build a detection data pipeline, conducted security research, and innovated detection based on machine learning. Previously, as a senior security engineer at Oracle, he helped build security products: Database Vault, Database Privilege Analyzer, and Database Assessment Tool. Kaizhe holds an MS degree in information security from Carnegie Mellon University.
Read more about Kaizhe Huang

author image
Pranjal Jumde

Pranjal Jumde is a senior security engineer at Brave Inc. In the security industry, he has worked on different aspects of security, such as browser security, OS/kernel security, DevSecOps, web application security, reverse engineering malware, security automation, and the development of security/privacy features. Before joining Brave, as an employee at Stackrox, Pranjal helped in the development of detection and enforcement features for the runtime detection platform. He has also worked at Apple and Adobe, where he worked on the development of features to harden various platforms. Pranjal holds an MS degree in information security from Carnegie Mellon University. He has also presented his research at different conferences, such as ACM CCS and BSides SF/Delhi.
Read more about Pranjal Jumde

Other recommended products

Related to this chapter

Kubernetes - A Complete DevOps Cookbook

Kubernetes - A Complete DevOps Cookbook

Kubernetes is one of the most popular, sophisticated, and fast-evolving container orchestrators. In this book, you’ll learn the essentials and find out about the advanced administration and orchestration techniques in Kubernetes. Readers will also learn to manage containers using the latest version of Kubernetes with a recipe-based approach.

BookMar 2020584 pages
The DevOps 2.3 Toolkit

The DevOps 2.3 Toolkit

Viktor Farcic’s latest book, The DevOps 2.3 Toolkit: Kubernetes, will take you on a hands-on journey with Viktor into the world of Kubernetes, and the tools not only behind the official project but also the wide-range of third-party apps that are available for you to use.

BookSep 2018418 pages
Cloud Native with Kubernetes

Cloud Native with Kubernetes

Cloud Native with Kubernetes will guide you effectively - from your first steps using Kubernetes right up to running enterprise-grade cloud native applications with best practices. The book covers every aspect of deploying, securing, and operating modern cloud native applications on Kubernetes.

BookJan 2021446 pages
Kubernetes Cookbook

Kubernetes Cookbook

Kubernetes is one of the most popular, sophisticated, and fast-evolving container orchestrators. In this book, you’ll learn the essentials and find out about the advanced administration in Kubernetes. We’ll take you through a step-by-step hands-on approach, which will familiarize you with the Kubernetes ecosystem.

BookMay 2018554 pages
The Kubernetes Workshop

The Kubernetes Workshop

This workshop takes you through a Kubernetes-oriented application delivery pipeline in a practical way. You’ll learn how to manage containers efficiently and scale and stabilize cloud-native applications using Kubernetes.

BookSep 2020780 pages
Kubernetes and Docker - An Enterprise Guide

Kubernetes and Docker - An Enterprise Guide

Complete with practical examples and explanations to address running Kubernetes in an enterprise, this book guides you to integrating Kubernetes clusters with load-balancers, external name resolution for services, OIDC using an enterprise directory, Kubernetes impersonation, security using PSPs and OPA, advanced auditing and reporting, backing up workloads, and provisioning a platform.

BookNov 2020526 pages
DevOps with Kubernetes

DevOps with Kubernetes

Kubernetes is a reliable container orchestration framework. It makes things easier - building load testing websites, creating a staging environment or moving business online to production. With Kubernetes, the speed of development, testing, and deployment can be improved and accelerated. Upon completion of this book, you’ll learn not only handy DevOps skills including containerization, monitoring, logging and continuous delivery but also Kubernetes deployment and administration on popular public clouds.

BookOct 2017382 pages
The Kubernetes Book

The Kubernetes Book

This easy-to-read book is your one-stop solution to learning all the important and fundamental parts of Kubernetes. You’ll learn how to develop your applications with Kubernetes, deploy to your chosen cloud platform, migrate to a different cloud platform, and even migrate to your private cloud at your on-premises datacenter.

BookJun 2019228 pages
Docker Certified Associate (DCA): Exam Guide

Docker Certified Associate (DCA): Exam Guide

With the rise of containerization, skills in containers especially Docker have higher market value. Docker Certified Associate (DCA) is the official exam designed to validate that skillset with real-world questions. This book will cover all topics required to successfully pass the Docker Certified Associate exam.

BookSep 2020612 pages
Introduction to DevOps with Kubernetes

Introduction to DevOps with Kubernetes

Introduction to DevOps with Kubernetes addresses the widespread problems faced by developers who are starting out with DevOps using Kubernetes. You’ll build out example portfolio pieces and tackle intellectually stimulating challenges that will help prepare you for technical screenings and complex software lifecycle problems.

BookMay 2019374 pages
DevOps with Kubernetes

DevOps with Kubernetes

This book will guide you from container basic concepts to orchestrating containerized applications in Kubernetes. You’ll learn about the Kubernetes basic architecture, components, resources, admission control, and extensions. We’ll show you how to utilize Kubernetes services in three top cloud providers.

BookJan 2019484 pages
Kubernetes Design Patterns and Extensions

Kubernetes Design Patterns and Extensions

Kubernetes is an open source platform that automates scaling, deployment, and management of container-based applications. The book starts by explaining basics about container orchestration and then moves on to explain how the components of a complex system, such as Kubernetes, interact with each other and helps develop vital skills for troubleshooting Kubernetes clusters and applications running in Kubernetes clusters. Once you are done reading the book, you can easily develop and deploy your own applications with Kubernetes in no time.

BookSep 2018106 pages

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages
Automotive Cybersecurity Engineering Handbook

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages
Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages
Cloud Penetration Testing for Red Teamers

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages
ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5
Burp Suite Cookbook

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages
Building and Automating Penetration Testing Labs in the Cloud

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages
Ethical Hacking Workshop

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages
Windows Forensics Analyst Field Guide

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages
Implementing DevSecOps Practices

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages