Kubernetes Cluster Security Audit Explained

Kubernetes Cluster Security Audit Explained

Cloud Security Podcast - we are continuing with our "Kubernetes Security & KubeCon EU 2023" and for the fourth episode in this series Shane Lawrence and Daniele Santos from Shopify explained how kube-audit an open source tool from Shopify. They spoke about how they have used the audit tool to improve security with a developer security lens.


Episode ShowNotes, Links and Transcript on Cloud Security Podcast: ⁠⁠⁠⁠⁠www.cloudsecuritypodcast.tv⁠⁠⁠⁠⁠


FREE CLOUD BOOTCAMPs on ⁠⁠⁠⁠⁠www.cloudsecuritybootcamp.com⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠)

Guest Socials: Shane Lawrence (Shane's Linkedin) and Daniele Santos (Dani's Linkedin)

Podcast Twitter - ⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠@CloudSecureNews⁠⁠⁠⁠⁠


If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠Cloud Security News ⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Questions

(00:00) Introduction

(02:52) A bit about Shane

(03:45) A bit about Dani

(04:23) Which kubecons have Shane and Dani attended?

(05:03) A bit about Dani and Shane's talk at Kubecon EU

(06:42) Misconfigurations in Kubernetes

(09:48) Dani talks about the Kubernetes Security Report

(10:13) Use case for Kubernetes Misconfiguration

(11:45) What is Azure Escape?

(12:51) What is container escape?

(15:26) What is kubeaudit?

(15:49) Contributing to kubeaudit

(16:40) The maturity of kubeaudit

(19:04) How would kubeaudit help with an azure escape?

(19:41) The developer experience

(21:34) How shopify uses kubeaudit

(24:59) Getting started with kubeaudit

(25:53) Challenges with implementing kubeaudit

(27:19) Maturity of kubernetes security and kubecon

(30:02) Learning about kubernetes

(34:07) Areas of security not being spoken about enough

(36:16) Open Source and Software supply chain risks


See you at the next episode!

Episoder(343)

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Is your security team treating your Identity Provider (IDP) like a firewall? In this episode, Adam Bateman (CEO & Co-founder of Push Security) explains why that's a dangerous mistake and how modern at...

10 Mar 46min

Is AI Hallucinations a Myth and the Real Threat from AI

Is AI Hallucinations a Myth and the Real Threat from AI

Are attackers really using AI to run end-to-end cyber campaigns? In this episode, Edward Wu (Founder and CEO, DropzoneAI) joins Ashish to separate the hype from reality when it comes to AI-driven atta...

6 Mar 40min

Why AI Infrastructure is Harder to Secure Than Cloud

Why AI Infrastructure is Harder to Secure Than Cloud

Is AI security just "Cloud Security 2.0"? Toni De La Fuente, creator of the open-source tool Prowler, joins Ashish to explain why securing AI workloads requires a fundamentally different approach than...

20 Feb 34min

How Attackers Bypass AI Guardrails with Natural Language

How Attackers Bypass AI Guardrails with Natural Language

In the world of Generative AI, natural language has become the new executable. Attackers no longer need complex code to breach your systems, sometimes, asking for a "poem" is enough to steal your pass...

10 Feb 46min

Vulnerability Management vs. Exposure Management

Vulnerability Management vs. Exposure Management

In this episode, Brad Hibbert (COO & Chief Strategy Officer at Brinqa) joins Ashish to explain why traditional risk-based vulnerability management (RBVM) is no longer enough in a cloud-first world .We...

6 Feb 39min

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is "developer-friendly" AI security actually possible? In this episode, Bryan Woolgar-O'Neil (CTO & Co-founder of Harmonic Security) joins Ashish to dismantle the traditional "block everything" approa...

5 Feb 1h 3min

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Is the AI SOC a reality, or just vendor hype? In this episode, Antoinette Stevens (Principal Security Engineer at Ramp) joins Ashish to dissect the true state of AI in detection engineering.Antoinette...

21 Jan 52min

AI Vulnerability Management: Why You Can't Patch a Neural Network

AI Vulnerability Management: Why You Can't Patch a Neural Network

Traditional vulnerability management is simple: find the flaw, patch it, and verify the fix. But what happens when the "asset" is a neural network that has learned something ethically wrong? In this e...

13 Jan 41min

Populært innen Teknologi

lydartikler-fra-aftenposten
romkapsel
teknisk-sett
shifter
rss-impressions-2
tomprat-med-gunnar-tjomlid
energi-og-klima
rss-ki-praten
fornybaren
elektropodden
nasjonal-sikkerhetsmyndighet-nsm
pedagogisk-intelligens
rss-ai-forklart
hans-petter-og-co
smart-forklart
rss-digitaliseringspadden
rss-praktisk-proptech
rss-alt-vi-kan
rss-bouvet-bobler
rss-startup