Thread by @richburroughs

All the cool kids are at @urlichsanais and @raesene’s talk. #KubeCon

Love you, security nerds ❤️ #KubeCon

Oh I didn’t know that @raesene works on the CIS benchmarks for both Docker and Kubernetes. #KubeCon

Someone will ask “Is this secure?” And that’s where standards come in, it’s how you can prove something is secure. #KubeCon

Security standards: “Guidance from a vendor or 3rd party on the security configuration and hardening of a product or service.”

Some standards are checklists. They are pass/fail for the checklist items. Others are hardening guides which are less prescriptive. #KubeCon

If you’re regulated, which standard you use may be answered for you. #KubeCon

Some distros have their own standards but many do not. The CIS benchmark may give false negatives or positives depending on your distro. You also need to look at which versions of k8s are covered by a standard. #KubeCon

Another question is what areas does the standard cover. Hardening guides are wider but at a higher level. Configuration benchmarks typically look just at the product. #KubeCon

#KubeCon

One of the tools available is kube-bench by Aqua. github.com/aquasecurity/k… #KubeCon

kube-beacon can do CIS benchmarks. Starboard can do the NSA standard. Another option is Kubescape which looks pretty cool. #KubeCon

Standards are a useful guide but it’s important to understand what they do and don’t cover. Tools can automate things but they should be used carefully. They have limitations. #KubeCon