Introducing the OWASP Top 10 for Kubernetes
summary
Kubernetes misconfiguration is the top risk with 60% experienced misconfiguration in one survey; common fixes are concrete: set pod securityContext (no root, read-only rootfs), enforce policies with OPA Gatekeeper or Kyverno, and block bad images via SBOM and image signing. Scan images, prefer scratch/distroless/Alpine, run kube-bench for CIS, use Falco for runtime detection, audit logs centrally, disable auto-mount of the default service account, apply network policies or service mesh, and keep Kubernetes and third-party components regularly upgraded.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:00How secure is Kubernetes
- 3:45Insecure workload configurations
- 8:22Supply chain vulnerabilities
- 13:29Overly permissive RBack configuration
- 19:27Lack of centralized policy enforcement
- 21:39Inadequate logging and monitoring
- 24:36Broken authentication
- 27:20Missing network segmentation
- 28:29Redis example
- 30:10Service Mesh
- 31:58Secret Management
- 37:06Components
- 38:55CIS Benchmark
- 39:55API Versions
- 42:20Kubernetes isnt secure
- 43:18Questions
related talks
22mIntroducing the OWASP Top Ten for Kubernetes
32mOWASP Kubernetes in-depth - Nigel Douglas
18mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
19mKubernetes Security: Navigating the Real-World Challenges
38mFrom Risks to Resilience: Leveraging CNCF Projects Against Kube...
20m10 Common Things People Do Wrong in K8s Environments
34mKubernetes Security 101: Best Practices to Secure Your Cluster
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era