Too Much to Choose – Making Sense of a Smorgasbord of Security Standard
summary
Compares concrete standards: CIS Benchmark (checks are prescriptive, target kubeadm/AKS/EKS/GKE/OpenShift and specific k8s versions like 1.20/1.23), NSA hardening guide (higher‑level, less prescriptive), and DISA STIG/PPCI draft gaps; highlights a missing CIS-style bench for containerd/CRI and stale rules referencing k8s 1.12. Demonstrates tools that produce runnable artifacts: kube-bench creates per-node K8s resources, starboard emits CIS/NSA reports and exports metrics to Grafana, and kubescape offers CLI/Helm scans plus a hosted UI; scanners only catch workloads present at scan time.
AI-written summary · about
chapters (13)
- 0:00Intro
- 2:15Overview
- 2:49Definition
- 3:41Types of Standards
- 4:57Kubernetes
- 7:39Which should you choose
- 8:05Which distributions are covered
- 10:10Which versions of Kubernetes are covered
- 12:39What areas are covered
- 14:18The details
- 18:05CI tools
- 23:34Summary
- 26:12Questions
related talks
26mKubernetes Risk Assessment: Time to Go One Level Deeper
24mA Checklist for Security from the Container to the Kubernetes: An Overview End to End
10mLightning Talk: Kubernetes Risk Assessment: Time to go one level deeper
06mLightning Talk: Why you Should Really Pay Attention to K8S Security Best Practices - Benjy Portnoy
46mContinuous Kubernetes Security- 24mA Checklist for Security from the Container to the Kubernetes: An Overview End to End
22mSecuring Kubernetes
26mMulti-layer hardening in Kubernetes