Dig deeper into OWASP Kubernetes

address 28 avenue George V 75008 Paris

During the talk, we want to make a walkthrough of the OWASP Kubernetes project, which is growing due to the ever increasing adoption of Kubernetes in enterprises.
We want to create different scenarios to show each of the risks and how using different open source tools we can check if everything is configured correctly or what actions we should perform.

We will group the content of the talk into 3 sections:

  • Misconfigurations
    Insecure Workload Configurations
    Overly Permissive RBAC Configurations
    Missing Network Segmentation Controls
    Secrets Management Failures
    Misconfigured Cluster Components
  • Vulnerabilities
    Supply chains
    Broken Authentication Mechanisms
  • Insufficient measures
    Lack of Centralized Policy Enforcement
    Inadequate Logging and Monitoring

For every section we will provide the context, the explanation and the red and blue team perspectives, with demos to show what are the risks and how to properly secure Kubernetes clusters.
Attendees will take away from the talk the techniques, open source tools and scenarios that can occur when running applications on a Kubernetes cluster.