Keynote: K8s Security Safari: Hunting Threats in the Wild Wild Cloud
summary
Focuses on EKS on AWS: uses CloudWatch, CloudTrail and GuardDuty, and inspects Kubernetes API server audit logs and the authenticator log to find threats. Demonstrates hunting a persisted backdoor created via create-access-entry where a foreign principal ARN is granted IRSA-style access, then shows the authenticator log giving connection time, the audit log giving source IP and API actions, and correlates pod role activity to S3 access via IRSA, flagging an anomalous spike May 12–17 as the investigation lead.
AI-written summary · about
chapters (10)
- 0:00K8s security challenges
- 1:25Why Kubernetes in the cloud simplifies operations
- 2:29Key logs for K8s investigations
- 3:33Threat hunting importance
- 4:58Steps to hunt threats in K8s
- 6:23Detecting persistent access
- 8:09Pods secure cloud access
- 9:56Anomaly analysis in detection
- 10:59Summary and next steps
- 11:44Key takeaways
related talks
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
06mKeynote: Future-Proofing Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
33mSecuring Kubernetes in the Cloud
12mKeynote: Security and the OODA Loop - Liz Rice, Technology Evangelist, Aqua Security
26mHacking into Kubernetes Security for Beginners