Videos

While we hav learned to scan configurations automatically and protect workloads the content of the container images is still a mess. Disputed CVE's. multiple ersions of not needed software, entire build environments in production system are the finding the speaker discovers during the preparation of audit in critical infrastrucure.

Practical experiences implementing security in critical infrastructure projects. The talk is about how to or how to not implement cloud native projects in highly regulated environments. You will get some insights into real world projects where Kubernetes is used to run the latest applications controlling critical infrastructure in Germany and Europe. The examples include container hardening and how to convince developers to deliver minimal and compliant containers, onboarding security team members to get the Sec into DevOps, running CI/CD pipelines with 3rd party vendors, air gapped cloud native architectures and running clusters with the highest availability.

Minimizing the size and the attack vectors are just two sides of the same coin. As a reward, you get much faster deployment pipelines, enabling more automated testing and higher scalability. A speed up by a factor of 10 or 20 is not unusual, sometimes the size of a cointainer shrinks by a factor of 100.

In December 2021 the Log4Shell bug caused major damages nearly everywhere, and the first time the blast radius of a bug reached Mars, causing damages of several 1000 Millions. How can we prevent events like this in the future? How can we leverage the amount of 10 Mio € to the substantial sum.

The Kubernetes security awareness increases during the last years, which is very important - there were always gaps. What is the biggest security gap? And how you can achieve Kubernetes security?

Security is a vital part of any development pipeline, but as we move towards dynamic Cloud DevOps, it’s becoming left behind. With Kubernetes having worrying security flaws, we talked to Thomas Fricke to learn more about how to keep our DevOps setup secure.

Tokens are a powerful way of controlling the access to to Rest APIs. Chasing them should be hard. Unfortunately, there is a widespread habit of leaving tokens lying around allowing very powerful attack vectors. An attack demonstrates how to hack an OpenShift cluster, which is fully securty compliant to the accepted standards of NIST and CIS. Hijacking a container gives full control to the cluster, including host access. If running in the cloud, the cluster can be used for further attacks, because the host has another token to the cloud API server. With this token, arbitrary accounts and cloud resources can be controlled, including virtual machines, storage and derived accounts.