WEBVTT

1
00:00:11.095 --> 00:00:12.765
<00:00:11.095>Quite <00:00:11.445>a <00:00:11.795>few <00:00:12.145>people <00:00:12.495>here.

2
00:00:12.765 --> 00:00:16.405
<00:00:12.765>That's <00:00:12.920>good <00:00:13.076>for <00:00:13.231>me. <00:00:13.387>That's, <00:00:13.542>uh, <00:00:13.698>just <00:00:13.853>a <00:00:14.009>little <00:00:14.165>bit

3
00:00:16.405 --> 00:00:19.645
<00:00:16.405>of <00:00:16.560>nervousness <00:00:16.716>every <00:00:16.871>time <00:00:17.027>I <00:00:17.182>talk, <00:00:17.338>uh, <00:00:17.493>in <00:00:17.649>the <00:00:17.805>beginning,

4
00:00:20.145 --> 00:00:21.845
<00:00:20.145>but <00:00:20.345>I <00:00:20.544>think <00:00:20.745>we <00:00:20.945>will <00:00:21.145>settle <00:00:21.345>that <00:00:21.544>in.

5
00:00:22.735 --> 00:00:25.605
<00:00:22.735>Thank <00:00:22.935>you <00:00:23.134>for <00:00:23.335>joining <00:00:23.535>my <00:00:23.735>talk <00:00:23.935>about <00:00:24.134>Kubernetes

6
00:00:25.845 --> 00:00:26.925
<00:00:25.845>Security <00:00:26.331>best <00:00:26.817>practices.

7
00:00:28.585 --> 00:00:31.925
<00:00:28.585>My <00:00:28.785>name <00:00:28.985>is, <00:00:29.185>and <00:00:29.385>if <00:00:29.585>this <00:00:29.785>would <00:00:29.985>work.

8
00:00:35.705 --> 00:00:40.645
<00:00:35.705>Oh, <00:00:35.860>perfect. <00:00:36.016>As <00:00:36.171>earlier <00:00:36.327>said, <00:00:36.482>my <00:00:36.638>name <00:00:36.793>is <00:00:36.949>Rico <00:00:37.105>Commander.

9
00:00:41.385 --> 00:00:44.005
<00:00:41.385>I'm <00:00:41.618>a <00:00:41.851>senior <00:00:42.085>security <00:00:42.318>consultant <00:00:42.551>at <00:00:42.785>Esso.

10
00:00:45.205 --> 00:00:47.245
<00:00:45.205>ADE <00:00:45.360>was <00:00:45.516>a <00:00:45.671>full <00:00:45.827>service <00:00:45.982>IT <00:00:46.138>provider <00:00:46.293>here <00:00:46.449>in <00:00:46.605>Germany.

11
00:00:47.375 --> 00:00:50.765
<00:00:47.375>Maybe <00:00:47.530>some <00:00:47.686>of <00:00:47.841>you <00:00:47.997>know, <00:00:48.152>if <00:00:48.308>not, <00:00:48.463>it's <00:00:48.619>okay <00:00:48.775>too.

12
00:00:51.345 --> 00:00:56.245
<00:00:51.345>Um, <00:00:51.545>I <00:00:51.745>did <00:00:51.945>full <00:00:52.144>stack <00:00:52.345>dev <00:00:52.545>like <00:00:52.745>till

13
00:00:56.245 --> 00:00:57.245
<00:00:56.245>three <00:00:56.695>years <00:00:57.144>ago.

14
00:00:57.795 --> 00:01:01.005
<00:00:57.795>Then <00:00:57.950>I <00:00:58.106>decided <00:00:58.261>I <00:00:58.417>like <00:00:58.572>to <00:00:58.728>build, <00:00:58.883>uh, <00:00:59.039>to <00:00:59.195>break

15
00:01:01.905 --> 00:01:03.045
<00:01:01.905>and <00:01:02.418>securing <00:01:02.931>stuff.

16
00:01:03.905 --> 00:01:08.885
<00:01:03.905>And <00:01:04.045>now <00:01:04.185>I <00:01:04.325>would <00:01:04.465>call <00:01:04.605>myself <00:01:04.745>for <00:01:04.885>those <00:01:05.025>who <00:01:05.165>are <00:01:05.305>terminators.

17
00:01:10.025 --> 00:01:13.005
<00:01:10.025>Of <00:01:10.258>course, <00:01:10.491>this <00:01:10.725>is <00:01:10.958>a <00:01:11.191>fantasy <00:01:11.425>character

18
00:01:13.625 --> 00:01:18.005
<00:01:13.625>and <00:01:13.765>it's <00:01:13.905>not <00:01:14.045>good <00:01:14.185>at <00:01:14.325>anything <00:01:14.465>because <00:01:14.605>it <00:01:14.745>can <00:01:14.885>do <00:01:15.025>everything,

19
00:01:18.025 --> 00:01:19.525
<00:01:18.025>but <00:01:18.362>it <00:01:18.700>can't <00:01:19.037>do <00:01:19.375>anything.

20
00:01:20.265 --> 00:01:21.845
<00:01:20.265>Um, <00:01:20.545>but <00:01:20.825>it's <00:01:21.105>still <00:01:21.385>quite <00:01:21.665>funny

21
00:01:21.845 --> 00:01:23.925
<00:01:21.845>because <00:01:22.125>I <00:01:22.405>got <00:01:22.685>from <00:01:22.965>software <00:01:23.245>development

22
00:01:24.025 --> 00:01:26.125
<00:01:24.025>to <00:01:24.725>cybersecurity <00:01:25.425>consulting,

23
00:01:26.125 --> 00:01:30.045
<00:01:26.125>and <00:01:26.265>now <00:01:26.405>I <00:01:26.545>have <00:01:26.685>like <00:01:26.825>three <00:01:26.965>dimensions <00:01:27.105>I'm <00:01:27.245>mainly <00:01:27.385>working <00:01:27.525>in,

24
00:01:30.045 --> 00:01:32.325
<00:01:30.045>which <00:01:30.325>is <00:01:30.605>application <00:01:30.885>cloud <00:01:31.165>and <00:01:31.445>ai.

25
00:01:33.065 --> 00:01:37.005
<00:01:33.065>Who, <00:01:33.345>ai, <00:01:33.625>maybe <00:01:33.905>we <00:01:34.185>should <00:01:34.465>keep

26
00:01:37.005 --> 00:01:38.085
<00:01:37.005>that <00:01:37.329>aside <00:01:37.653>for <00:01:37.977>today.

27
00:01:38.265 --> 00:01:39.445
<00:01:38.265>Not <00:01:38.795>quite <00:01:39.327>everything.

28
00:01:40.265 --> 00:01:42.605
<00:01:40.265>Um, <00:01:40.545>but <00:01:40.825>that's <00:01:41.105>why <00:01:41.385>I <00:01:41.665>decided

29
00:01:42.665 --> 00:01:44.365
<00:01:42.664>to <00:01:42.945>like <00:01:43.225>change <00:01:43.505>my <00:01:43.785>profile <00:01:44.065>picture

30
00:01:44.785 --> 00:01:47.165
<00:01:44.785>and <00:01:44.925>have <00:01:45.065>now <00:01:45.205>an <00:01:45.345>I <00:01:45.485>in <00:01:45.625>de <00:01:45.765>one <00:01:45.905>misso <00:01:46.045>a <00:01:46.185>check

31
00:01:47.165 --> 00:01:48.725
<00:01:47.164>of <00:01:47.398>all <00:01:47.631>trades <00:01:47.865>from <00:01:48.098>my, <00:01:48.331>my <00:01:48.565>picture

32
00:01:50.465 --> 00:01:54.805
<00:01:50.465>and <00:01:50.640>I'm <00:01:50.815>a <00:01:50.990>contributor <00:01:51.165>at <00:01:51.340>different <00:01:51.515>oasp <00:01:51.690>Open <00:01:51.865>Worldwide

33
00:01:54.805 --> 00:01:56.285
<00:01:54.805>application <00:01:55.471>security <00:01:56.137>project.

34
00:01:57.025 --> 00:02:01.165
<00:01:57.025>Um, <00:01:57.180>project. <00:01:57.336>Now <00:01:57.491>it <00:01:57.647>got <00:01:57.802>doubled <00:01:57.958>with <00:01:58.113>the, <00:01:58.269>uh, <00:01:58.425>name.

35
00:02:03.065 --> 00:02:07.125
<00:02:03.065>So <00:02:03.181>the, <00:02:03.298>if <00:02:03.414>you <00:02:03.531>count <00:02:03.648>how <00:02:03.765>many <00:02:03.881>talks <00:02:03.998>it <00:02:04.115>did <00:02:04.231>today, <00:02:04.348>how <00:02:04.465>many

36
00:02:07.125 --> 00:02:11.085
<00:02:07.125>of <00:02:07.265>them <00:02:07.405>were <00:02:07.545>about <00:02:07.685>ai, <00:02:07.825>just <00:02:07.965>like, <00:02:08.104>if <00:02:08.245>it's <00:02:08.384>above <00:02:08.525>three,

37
00:02:11.315 --> 00:02:12.685
<00:02:11.315>just <00:02:11.726>raise <00:02:12.137>your <00:02:12.548>hands.

38
00:02:13.465 --> 00:02:18.085
<00:02:13.465>So <00:02:13.592>this <00:02:13.719>is <00:02:13.846>like <00:02:13.974>80% <00:02:14.101>of <00:02:14.228>the <00:02:14.355>all <00:02:14.483>the <00:02:14.610>people <00:02:14.737>sitting <00:02:14.865>here.

39
00:02:18.785 --> 00:02:20.405
<00:02:18.785>Um, <00:02:19.065>and <00:02:19.345>I <00:02:19.625>see <00:02:19.905>it <00:02:20.185>everywhere.

40
00:02:20.605 --> 00:02:21.685
<00:02:20.605>I <00:02:20.929>also <00:02:21.253>did <00:02:21.577>many,

41
00:02:21.685 --> 00:02:23.965
<00:02:21.685>many <00:02:21.860>AI <00:02:22.035>security <00:02:22.210>talks <00:02:22.385>in <00:02:22.560>the <00:02:22.735>last <00:02:22.910>few <00:02:23.085>months

42
00:02:24.465 --> 00:02:26.485
<00:02:24.465>and <00:02:24.665>I <00:02:24.865>was <00:02:25.065>thinking <00:02:25.265>like, <00:02:25.465>okay, <00:02:25.665>I'm <00:02:25.865>getting

43
00:02:27.525 --> 00:02:30.405
<00:02:27.525>a <00:02:27.700>little <00:02:27.875>bit <00:02:28.050>stuffed <00:02:28.225>up <00:02:28.400>now <00:02:28.575>with <00:02:28.750>AI <00:02:28.925>security

44
00:02:30.585 --> 00:02:32.605
<00:02:30.585>and <00:02:30.785>all <00:02:30.985>the <00:02:31.185>AI <00:02:31.385>stuff, <00:02:31.585>so <00:02:31.785>I <00:02:31.985>decided

45
00:02:34.045 --> 00:02:36.645
<00:02:34.045>I <00:02:34.200>should <00:02:34.356>do <00:02:34.511>something <00:02:34.667>which <00:02:34.822>is <00:02:34.978>underlying <00:02:35.133>about <00:02:35.289>all <00:02:35.445>the

46
00:02:36.645 --> 00:02:37.965
<00:02:36.645>chain <00:02:36.942>AI <00:02:37.239>and <00:02:37.536>AI <00:02:37.833>stuff.

47
00:02:39.425 --> 00:02:42.965
<00:02:39.425>And <00:02:39.580>I <00:02:39.736>was <00:02:39.891>thinking <00:02:40.047>like, <00:02:40.202>okay, <00:02:40.358>what <00:02:40.513>did <00:02:40.669>chain <00:02:40.825>AI

48
00:02:42.965 --> 00:02:45.525
<00:02:42.965>or <00:02:43.198>AI <00:02:43.431>really <00:02:43.665>change <00:02:43.898>in <00:02:44.131>our <00:02:44.365>landscape

49
00:02:45.525 --> 00:02:47.205
<00:02:45.525>or <00:02:45.875>in <00:02:46.225>our <00:02:46.575>software <00:02:46.925>architectures?

50
00:02:47.945 --> 00:02:50.565
<00:02:47.945>If <00:02:48.100>we <00:02:48.256>look <00:02:48.411>at, <00:02:48.567>uh, <00:02:48.722>like <00:02:48.878>on <00:02:49.033>the <00:02:49.189>left <00:02:49.345>side,

51
00:02:50.565 --> 00:02:52.645
<00:02:50.565>traditional <00:02:50.845>software <00:02:51.125>on <00:02:51.405>the <00:02:51.685>right <00:02:51.965>side,

52
00:02:52.995 --> 00:02:54.485
<00:02:52.995>more <00:02:53.442>about <00:02:53.889>LLM <00:02:54.336>integrated

53
00:02:55.035 --> 00:02:58.325
<00:02:55.035>application <00:02:55.234>software <00:02:55.435>architectures, <00:02:55.635>then <00:02:55.835>we <00:02:56.035>can <00:02:56.234>look <00:02:56.435>at,

54
00:02:58.385 --> 00:03:02.165
<00:02:58.385>at <00:02:58.560>edit <00:02:58.734>the <00:02:58.910>infrastructure <00:02:59.084>we <00:02:59.260>made <00:02:59.435>mostly <00:02:59.609>the <00:02:59.785>same,

55
00:03:03.745 --> 00:03:06.365
<00:03:03.745>the <00:03:04.095>platform, <00:03:04.445>oh, <00:03:04.795>no, <00:03:05.145>that's

56
00:03:06.365 --> 00:03:07.405
<00:03:06.365>what <00:03:06.552>we <00:03:06.739>are <00:03:06.926>talking <00:03:07.113>about <00:03:07.301>today.

57
00:03:07.705 --> 00:03:09.485
<00:03:07.705>We, <00:03:07.985>we <00:03:08.265>made <00:03:08.545>mostly <00:03:08.825>the <00:03:09.105>same.

58
00:03:11.225 --> 00:03:13.045
<00:03:11.225>One <00:03:11.458>time <00:03:11.691>we <00:03:11.924>made <00:03:12.158>mostly <00:03:12.391>the <00:03:12.625>same,

59
00:03:13.705 --> 00:03:17.005
<00:03:13.705>and <00:03:13.845>it's <00:03:13.985>just <00:03:14.125>changed <00:03:14.265>the <00:03:14.405>top <00:03:14.545>of <00:03:14.685>the <00:03:14.825>layer, <00:03:14.965>which <00:03:15.105>we,

60
00:03:17.065 --> 00:03:19.205
<00:03:17.065>we <00:03:17.345>won't <00:03:17.625>talk <00:03:17.905>to <00:03:18.185>today <00:03:18.465>about.

61
00:03:20.265 --> 00:03:23.605
<00:03:20.265>So <00:03:20.420>it <00:03:20.576>didn't <00:03:20.731>change <00:03:20.887>really <00:03:21.042>that <00:03:21.198>much <00:03:21.353>on <00:03:21.509>the <00:03:21.665>case.

62
00:03:23.755 --> 00:03:24.805
<00:03:23.755>What <00:03:23.991>we <00:03:24.227>are <00:03:24.463>working <00:03:24.700>today,

63
00:03:28.785 --> 00:03:30.365
<00:03:28.785>We <00:03:29.135>are <00:03:29.484>talking <00:03:29.835>about <00:03:30.185>platform,

64
00:03:30.505 --> 00:03:33.165
<00:03:30.505>in <00:03:30.704>this <00:03:30.905>case <00:03:31.105>about <00:03:31.305>Kubernetes <00:03:31.505>security <00:03:31.704>best <00:03:31.905>practices.

65
00:03:33.785 --> 00:03:37.205
<00:03:33.785>And <00:03:33.912>when <00:03:34.039>I <00:03:34.166>was <00:03:34.294>looking <00:03:34.421>it <00:03:34.548>up, <00:03:34.675>I <00:03:34.803>was <00:03:34.930>thinking <00:03:35.057>like, <00:03:35.185>okay,

66
00:03:37.865 --> 00:03:41.285
<00:03:37.865>how <00:03:38.040>many <00:03:38.215>organizations <00:03:38.390>really <00:03:38.565>have <00:03:38.740>a <00:03:38.915>problem <00:03:39.090>with <00:03:39.265>Kubernetes

67
00:03:41.465 --> 00:03:43.205
<00:03:41.465>or <00:03:41.931>Kubernetes <00:03:42.398>security <00:03:42.865>incidents?

68
00:03:43.465 --> 00:03:46.205
<00:03:43.465>And <00:03:43.745>there's <00:03:44.025>a <00:03:44.305>cool <00:03:44.585>yearly <00:03:44.865>updated

69
00:03:46.805 --> 00:03:48.685
<00:03:46.805>Kubernetes <00:03:47.085>security <00:03:47.365>report <00:03:47.645>by <00:03:47.925>wet <00:03:48.205>hat.

70
00:03:48.985 --> 00:03:51.445
<00:03:48.985>And <00:03:49.140>if <00:03:49.296>you're <00:03:49.451>looking <00:03:49.607>at <00:03:49.762>it, <00:03:49.918>then <00:03:50.073>you <00:03:50.229>can <00:03:50.385>see

71
00:03:51.755 --> 00:03:53.845
<00:03:51.755>that <00:03:52.221>nearly <00:03:52.688>eight, <00:03:53.155>uh,

72
00:03:54.185 --> 00:03:58.205
<00:03:54.185>or <00:03:54.360>the <00:03:54.535>statement <00:03:54.710>of <00:03:54.885>the <00:03:55.060>um, <00:03:55.235>paper <00:03:55.410>also <00:03:55.585>states

73
00:03:58.205 --> 00:04:01.565
<00:03:58.204>that <00:03:58.360>nine <00:03:58.516>in <00:03:58.671>10 <00:03:58.827>organization <00:03:58.982>had <00:03:59.138>at <00:03:59.293>least <00:03:59.449>one <00:03:59.605>container

74
00:04:01.615 --> 00:04:04.205
<00:04:01.615>occup <00:04:01.815>security <00:04:02.015>incident <00:04:02.215>in <00:04:02.415>the <00:04:02.615>last <00:04:02.815>12 <00:04:03.015>months.

75
00:04:04.625 --> 00:04:07.125
<00:04:04.625>And <00:04:04.858>I <00:04:05.091>can <00:04:05.325>guarantee <00:04:05.558>you <00:04:05.791>not <00:04:06.025>200%

76
00:04:07.125 --> 00:04:09.565
<00:04:07.125>because <00:04:07.300>as <00:04:07.475>a <00:04:07.650>consultant, <00:04:07.825>I <00:04:08.000>don't <00:04:08.175>give <00:04:08.350>you, <00:04:08.525>okay,

77
00:04:09.565 --> 00:04:10.885
<00:04:09.565>that's <00:04:09.763>a <00:04:09.960>hundred <00:04:10.159>percent <00:04:10.357>at <00:04:10.555>that <00:04:10.753>thing,

78
00:04:11.385 --> 00:04:15.485
<00:04:11.385>but <00:04:11.524>I <00:04:11.665>could <00:04:11.804>most <00:04:11.945>certainly <00:04:12.084>say <00:04:12.225>that <00:04:12.364>also <00:04:12.505>the <00:04:12.644>second, <00:04:12.785>uh,

79
00:04:15.505 --> 00:04:18.845
<00:04:15.505>the <00:04:15.704>10th <00:04:15.905>organization <00:04:16.105>also <00:04:16.305>had <00:04:16.505>an <00:04:16.704>ex <00:04:16.904>incident,

80
00:04:18.945 --> 00:04:20.165
<00:04:18.945>but <00:04:19.164>they <00:04:19.384>just <00:04:19.603>don't <00:04:19.823>tell <00:04:20.043>it.

81
00:04:21.545 --> 00:04:25.005
<00:04:21.545>So <00:04:21.745>what <00:04:21.945>are <00:04:22.145>the <00:04:22.345>most, <00:04:22.545>uh, <00:04:22.745>security <00:04:22.945>incidents

82
00:04:25.005 --> 00:04:27.965
<00:04:25.005>or <00:04:25.205>issues, <00:04:25.405>uh, <00:04:25.605>related <00:04:25.805>to <00:04:26.005>containers <00:04:26.205>and <00:04:26.405>occupants?

83
00:04:28.345 --> 00:04:31.445
<00:04:28.345>And <00:04:28.500>you <00:04:28.656>can <00:04:28.811>see <00:04:28.967>that <00:04:29.122>there, <00:04:29.278>there <00:04:29.433>are <00:04:29.589>different <00:04:29.745>issues.

84
00:04:32.225 --> 00:04:35.645
<00:04:32.225>For <00:04:32.425>example, <00:04:32.625>um, <00:04:32.825>security <00:04:33.025>incident <00:04:33.225>during <00:04:33.425>one <00:04:33.625>time,

85
00:04:36.395 --> 00:04:39.045
<00:04:36.395>most <00:04:36.550>times <00:04:36.706>in <00:04:36.861>regard <00:04:37.017>of <00:04:37.172>the <00:04:37.328>application <00:04:37.483>underlying <00:04:37.639>in <00:04:37.794>the

86
00:04:39.685 --> 00:04:43.925
<00:04:39.685>kuber <00:04:39.918>cluster <00:04:40.151>or <00:04:40.385>detect, <00:04:40.618>uh, <00:04:40.851>or <00:04:41.085>misconfigurations

87
00:04:44.145 --> 00:04:45.605
<00:04:44.145>or <00:04:44.802>similar <00:04:45.459>things.

88
00:04:48.035 --> 00:04:50.725
<00:04:48.034>Just <00:04:48.210>to <00:04:48.385>put <00:04:48.559>it <00:04:48.734>a <00:04:48.909>little <00:04:49.085>bit <00:04:49.260>into <00:04:49.434>picture.

89
00:04:51.335 --> 00:04:54.925
<00:04:51.335>Often <00:04:51.490>if <00:04:51.646>we <00:04:51.801>talk <00:04:51.957>about <00:04:52.112>securing <00:04:52.268>the <00:04:52.423>whole <00:04:52.579>stuff <00:04:52.734>about

90
00:04:55.165 --> 00:04:57.565
<00:04:55.165>Kubernetes, <00:04:55.340>we <00:04:55.515>are <00:04:55.690>talking <00:04:55.865>also <00:04:56.040>about <00:04:56.215>the <00:04:56.390>four <00:04:56.565>Cs.

91
00:04:57.865 --> 00:05:00.565
<00:04:57.865>The <00:04:58.098>four <00:04:58.331>Cs <00:04:58.565>are <00:04:58.798>differentiated <00:04:59.031>in <00:04:59.265>cloud

92
00:05:01.065 --> 00:05:04.045
<00:05:01.065>or <00:05:01.344>the <00:05:01.625>covered <00:05:01.905>data <00:05:02.185>center <00:05:02.465>cluster,

93
00:05:04.045 --> 00:05:07.205
<00:05:04.045>which <00:05:04.220>we <00:05:04.395>are <00:05:04.570>talking <00:05:04.745>about <00:05:04.920>today, <00:05:05.095>container <00:05:05.270>and <00:05:05.445>code.

94
00:05:08.265 --> 00:05:12.285
<00:05:08.265>And <00:05:08.440>I <00:05:08.615>would <00:05:08.789>say <00:05:08.965>that <00:05:09.140>everything <00:05:09.315>is <00:05:09.490>equally <00:05:09.664>important.

95
00:05:12.705 --> 00:05:16.205
<00:05:12.705>If <00:05:12.905>you're <00:05:13.104>securing <00:05:13.305>your <00:05:13.505>Kubernetes <00:05:13.705>cluster, <00:05:13.905>that's <00:05:14.104>good,

96
00:05:16.665 --> 00:05:19.125
<00:05:16.665>but <00:05:16.840>if <00:05:17.015>you <00:05:17.190>have <00:05:17.365>some <00:05:17.540>misconfigurations <00:05:17.715>on <00:05:17.890>your <00:05:18.065>cloud

97
00:05:19.185 --> 00:05:23.285
<00:05:19.185>or <00:05:19.325>if <00:05:19.465>your <00:05:19.605>company <00:05:19.745>data <00:05:19.885>center, <00:05:20.025>this <00:05:20.165>could <00:05:20.305>be <00:05:20.445>bad <00:05:20.585>too.

98
00:05:23.715 --> 00:05:26.245
<00:05:23.715>Also, <00:05:23.870>if <00:05:24.026>you <00:05:24.181>have <00:05:24.337>a <00:05:24.492>vulnerable <00:05:24.648>application <00:05:24.803>running <00:05:24.959>in <00:05:25.114>your

99
00:05:26.565 --> 00:05:29.005
<00:05:26.565>Kubernetes <00:05:26.915>application, <00:05:27.265>uh, <00:05:27.615>Kubernetes <00:05:27.965>cluster,

100
00:05:29.315 --> 00:05:33.365
<00:05:29.315>this <00:05:29.455>could <00:05:29.594>also <00:05:29.735>lead <00:05:29.875>to <00:05:30.015>a <00:05:30.155>security <00:05:30.295>that, <00:05:30.435>so <00:05:30.575>it's <00:05:30.715>not

101
00:05:33.435 --> 00:05:35.485
<00:05:33.435>that <00:05:33.668>you <00:05:33.901>can <00:05:34.135>really <00:05:34.368>say <00:05:34.601>it's <00:05:34.835>black

102
00:05:35.485 --> 00:05:38.605
<00:05:35.485>and <00:05:35.625>white, <00:05:35.765>of <00:05:35.905>course, <00:05:36.045>you <00:05:36.185>need <00:05:36.325>to <00:05:36.465>secure <00:05:36.605>the <00:05:36.745>whole <00:05:36.885>stack

103
00:05:40.985 --> 00:05:44.245
<00:05:40.985>and <00:05:41.125>this, <00:05:41.265>uh, <00:05:41.405>and <00:05:41.545>when <00:05:41.685>I <00:05:41.825>was <00:05:41.965>researching <00:05:42.105>all <00:05:42.245>that <00:05:42.385>stuff,

104
00:05:45.045 --> 00:05:48.445
<00:05:45.045>I <00:05:45.220>also <00:05:45.395>stumbled <00:05:45.570>upon <00:05:45.745>this <00:05:45.920>threat <00:05:46.095>modeling, <00:05:46.270>which <00:05:46.445>you,

105
00:05:48.585 --> 00:05:50.525
<00:05:48.585>as <00:05:48.818>you <00:05:49.051>get <00:05:49.284>all <00:05:49.518>the <00:05:49.751>presentations <00:05:49.984>afterwards,

106
00:05:50.525 --> 00:05:53.925
<00:05:50.525>really <00:05:50.724>look <00:05:50.924>into <00:05:51.125>this <00:05:51.325>detailed <00:05:51.525>threat <00:05:51.724>model, <00:05:51.924>um,

107
00:05:54.255 --> 00:05:56.405
<00:05:54.255>about <00:05:54.534>our <00:05:54.815>Kubernetes <00:05:55.094>data <00:05:55.375>security <00:05:55.655>flow

108
00:05:56.745 --> 00:06:01.605
<00:05:56.745>and <00:05:56.872>where <00:05:56.999>things <00:05:57.126>could <00:05:57.254>go <00:05:57.381>wrong <00:05:57.508>and <00:05:57.635>where <00:05:57.763>it <00:05:57.890>could <00:05:58.017>be <00:05:58.145>worse.

109
00:06:05.585 --> 00:06:08.285
<00:06:05.585>But <00:06:05.760>for <00:06:05.935>today, <00:06:06.109>let's <00:06:06.284>look <00:06:06.460>at <00:06:06.635>some <00:06:06.810>best <00:06:06.984>practices,

110
00:06:08.395 --> 00:06:11.525
<00:06:08.395>what <00:06:08.570>we <00:06:08.745>can <00:06:08.919>do <00:06:09.094>better <00:06:09.270>in <00:06:09.445>our <00:06:09.620>Kubernetes <00:06:09.794>cluster,

111
00:06:12.385 --> 00:06:14.285
<00:06:12.385>and <00:06:12.618>let's <00:06:12.851>go <00:06:13.085>from <00:06:13.318>small <00:06:13.551>to <00:06:13.784>big.

112
00:06:14.545 --> 00:06:18.325
<00:06:14.545>So <00:06:14.672>we <00:06:14.799>will <00:06:14.926>start <00:06:15.054>with <00:06:15.181>images, <00:06:15.308>then <00:06:15.435>we <00:06:15.563>will <00:06:15.690>go <00:06:15.817>to <00:06:15.945>pots,

113
00:06:19.505 --> 00:06:24.405
<00:06:19.505>uh, <00:06:19.680>wall <00:06:19.855>based <00:06:20.030>access <00:06:20.205>control <00:06:20.380>network <00:06:20.555>policies, <00:06:20.730>the <00:06:20.905>ETCD

114
00:06:25.645 --> 00:06:28.685
<00:06:25.645>security <00:06:25.800>policies, <00:06:25.956>and <00:06:26.111>then <00:06:26.267>we <00:06:26.422>will <00:06:26.578>have <00:06:26.733>a <00:06:26.889>small <00:06:27.044>outro.

115
00:06:30.895 --> 00:06:35.405
<00:06:30.895>Let's <00:06:31.070>start <00:06:31.245>with <00:06:31.419>images. <00:06:31.594>What <00:06:31.770>is <00:06:31.945>a <00:06:32.120>secure <00:06:32.294>image?

116
00:06:36.345 --> 00:06:37.645
<00:06:36.345>If <00:06:36.579>we <00:06:36.813>look <00:06:37.047>at, <00:06:37.281>at <00:06:37.515>a

117
00:06:37.865 --> 00:06:42.285
<00:06:37.865>or <00:06:37.972>how <00:06:38.080>we <00:06:38.188>build <00:06:38.295>a <00:06:38.403>image, <00:06:38.511>if <00:06:38.618>we <00:06:38.726>look <00:06:38.834>at <00:06:38.941>it, <00:06:39.049>each <00:06:39.157>layer, <00:06:39.265>uh,

118
00:06:42.445 --> 00:06:43.605
<00:06:42.445>contains <00:06:42.967>some <00:06:43.489>command.

119
00:06:44.635 --> 00:06:47.405
<00:06:44.635>Most <00:06:44.868>times <00:06:45.101>installing <00:06:45.335>tools, <00:06:45.568>create <00:06:45.801>files, <00:06:46.034>one,

120
00:06:47.405 --> 00:06:49.405
<00:06:47.405>the <00:06:47.604>application <00:06:47.804>and <00:06:48.005>so <00:06:48.205>on <00:06:48.405>and <00:06:48.604>so <00:06:48.804>on.

121
00:06:55.835 --> 00:06:59.445
<00:06:55.835>What <00:06:56.034>are <00:06:56.234>the <00:06:56.435>security <00:06:56.635>issues <00:06:56.835>from <00:06:57.034>image <00:06:57.234>building?

122
00:06:59.825 --> 00:07:01.245
<00:06:59.825>Uh, <00:07:00.080>from <00:07:00.336>the <00:07:00.591>image <00:07:00.847>building <00:07:01.103>process

123
00:07:02.675 --> 00:07:07.525
<00:07:02.675>code <00:07:02.908>from <00:07:03.141>untrusted <00:07:03.375>registries, <00:07:03.608>vulnerabilities <00:07:03.841>in <00:07:04.075>tools

124
00:07:07.945 --> 00:07:10.045
<00:07:07.945>of <00:07:08.178>the <00:07:08.411>OS <00:07:08.645>or <00:07:08.878>in <00:07:09.111>the <00:07:09.344>libraries

125
00:07:10.625 --> 00:07:15.045
<00:07:10.625>and <00:07:10.858>also, <00:07:11.091>uh, <00:07:11.325>unnecessary, <00:07:11.558>unnecessary, <00:07:11.791>uh, <00:07:12.025>dependencies.

126
00:07:16.475 --> 00:07:20.165
<00:07:16.475>What <00:07:16.615>could <00:07:16.755>mean <00:07:16.895>that <00:07:17.035>for <00:07:17.175>our <00:07:17.315>cluster, <00:07:17.455>it <00:07:17.595>could <00:07:17.735>lead <00:07:17.875>to

127
00:07:20.945 --> 00:07:22.245
<00:07:20.945>access <00:07:21.335>to <00:07:21.725>the <00:07:22.115>host.

128
00:07:23.225 --> 00:07:27.165
<00:07:23.225>An <00:07:23.352>attacker <00:07:23.479>could <00:07:23.606>go <00:07:23.734>to <00:07:23.861>the <00:07:23.988>image <00:07:24.115>if <00:07:24.243>it's <00:07:24.370>a <00:07:24.497>vulnerable <00:07:24.625>image

129
00:07:27.165 --> 00:07:31.165
<00:07:27.165>or <00:07:27.305>if <00:07:27.445>we <00:07:27.585>have <00:07:27.725>some, <00:07:27.865>uh, <00:07:28.005>malicious <00:07:28.145>things <00:07:28.285>into <00:07:28.425>our <00:07:28.565>layers,

130
00:07:31.275 --> 00:07:33.925
<00:07:31.275>then <00:07:31.450>this <00:07:31.625>could <00:07:31.799>lead <00:07:31.974>into <00:07:32.150>breakout <00:07:32.325>of <00:07:32.500>this <00:07:32.674>image.

131
00:07:35.665 --> 00:07:38.565
<00:07:35.665>And <00:07:35.840>with <00:07:36.015>that, <00:07:36.190>we <00:07:36.365>could <00:07:36.540>go <00:07:36.715>to <00:07:36.890>other <00:07:37.065>containers

132
00:07:38.825 --> 00:07:41.045
<00:07:38.825>or, <00:07:39.175>um, <00:07:39.525>into <00:07:39.875>the <00:07:40.224>cluster.

133
00:07:42.505 --> 00:07:43.965
<00:07:42.505>We <00:07:42.767>could <00:07:43.030>read <00:07:43.293>as <00:07:43.556>an <00:07:43.819>attacker.

134
00:07:43.965 --> 00:07:45.125
<00:07:43.965>If <00:07:44.173>we <00:07:44.382>have <00:07:44.591>a <00:07:44.800>malicious <00:07:45.009>image

135
00:07:45.265 --> 00:07:48.845
<00:07:45.265>or <00:07:45.465>some, <00:07:45.664>uh, <00:07:45.865>vulnerability <00:07:46.065>in <00:07:46.265>our <00:07:46.465>build <00:07:46.664>image,

136
00:07:49.195 --> 00:07:51.005
<00:07:49.195>then <00:07:49.474>this <00:07:49.755>could <00:07:50.034>lead <00:07:50.315>to <00:07:50.594>that.

137
00:07:51.105 --> 00:07:54.085
<00:07:51.105>Uh, <00:07:51.260>the <00:07:51.416>attacker <00:07:51.571>could <00:07:51.727>read <00:07:51.882>data <00:07:52.038>in <00:07:52.193>the <00:07:52.349>host <00:07:52.505>volumes,

138
00:07:54.515 --> 00:07:55.845
<00:07:54.515>read <00:07:54.814>from <00:07:55.113>the <00:07:55.412>file <00:07:55.712>system

139
00:07:56.825 --> 00:07:59.925
<00:07:56.825>and <00:07:57.025>also <00:07:57.224>read, <00:07:57.425>uh, <00:07:57.625>the <00:07:57.825>cube <00:07:58.025>led <00:07:58.224>configs.

140
00:08:02.705 --> 00:08:06.205
<00:08:02.705>If <00:08:02.832>you <00:08:02.959>look <00:08:03.086>at <00:08:03.214>to <00:08:03.341>how <00:08:03.468>do <00:08:03.595>that, <00:08:03.723>we <00:08:03.850>can <00:08:03.977>achieve <00:08:04.104>that

141
00:08:06.345 --> 00:08:07.445
<00:08:06.345>to <00:08:06.840>image <00:08:07.335>scanning.

142
00:08:07.455 --> 00:08:08.925
<00:08:07.455>There <00:08:07.719>are <00:08:07.984>some <00:08:08.248>open <00:08:08.513>source <00:08:08.778>tools,

143
00:08:08.925 --> 00:08:10.565
<00:08:08.925>some <00:08:09.205>enterprise <00:08:09.485>tools <00:08:09.765>we <00:08:10.045>could <00:08:10.325>use,

144
00:08:10.815 --> 00:08:14.485
<00:08:10.815>which <00:08:10.942>would <00:08:11.069>be <00:08:11.196>like <00:08:11.324>in <00:08:11.451>this <00:08:11.578>case, <00:08:11.705>when <00:08:11.833>we <00:08:11.960>built <00:08:12.087>the <00:08:12.215>stage,

145
00:08:15.145 --> 00:08:17.245
<00:08:15.145>uh, <00:08:15.300>if <00:08:15.456>we, <00:08:15.611>as <00:08:15.767>soon <00:08:15.922>as <00:08:16.078>we <00:08:16.233>built <00:08:16.389>the <00:08:16.544>image,

146
00:08:17.305 --> 00:08:19.365
<00:08:17.305>we <00:08:17.585>do <00:08:17.865>a <00:08:18.145>image <00:08:18.425>scanning, <00:08:18.705>uh,

147
00:08:19.425 --> 00:08:21.325
<00:08:19.425>we <00:08:19.625>could <00:08:19.825>do <00:08:20.025>some <00:08:20.225>security <00:08:20.425>policy <00:08:20.625>on <00:08:20.825>that,

148
00:08:21.665 --> 00:08:25.285
<00:08:21.665>and <00:08:21.820>with <00:08:21.976>that, <00:08:22.131>we <00:08:22.287>could <00:08:22.442>achieve <00:08:22.598>a <00:08:22.753>more <00:08:22.909>secure <00:08:23.065>image.

149
00:08:27.105 --> 00:08:29.525
<00:08:27.105>And <00:08:27.305>with <00:08:27.505>that, <00:08:27.705>we <00:08:27.905>could, <00:08:28.105>uh, <00:08:28.305>achieve <00:08:28.505>that.

150
00:08:29.665 --> 00:08:33.005
<00:08:29.665>We <00:08:29.865>either <00:08:30.065>say <00:08:30.265>pass <00:08:30.465>or <00:08:30.665>not, <00:08:30.865>or <00:08:31.065>worm.

151
00:08:33.545 --> 00:08:36.885
<00:08:33.544>Uh, <00:08:33.745>most <00:08:33.944>times <00:08:34.145>you, <00:08:34.344>uh, <00:08:34.544>if <00:08:34.745>you're <00:08:34.944>staging

152
00:08:36.885 --> 00:08:38.965
<00:08:36.885>and <00:08:37.118>the <00:08:37.351>deaf <00:08:37.585>environment, <00:08:37.818>it's <00:08:38.051>firstly, <00:08:38.284>okay,

153
00:08:38.965 --> 00:08:40.245
<00:08:38.965>that's <00:08:39.253>maybe <00:08:39.541>just <00:08:39.829>a <00:08:40.116>worm,

154
00:08:40.465 --> 00:08:43.325
<00:08:40.465>but <00:08:40.620>for <00:08:40.776>productive, <00:08:40.931>I <00:08:41.087>wouldn't <00:08:41.242>suggest <00:08:41.398>that <00:08:41.553>you <00:08:41.709>do <00:08:41.865>it.

155
00:08:43.705 --> 00:08:48.005
<00:08:43.705>Uh, <00:08:43.860>if <00:08:44.016>there's <00:08:44.171>some <00:08:44.327>kind <00:08:44.482>of <00:08:44.638>security <00:08:44.793>vulnerability <00:08:44.949>in <00:08:45.105>it,

156
00:08:48.265 --> 00:08:53.245
<00:08:48.265>you <00:08:48.420>should <00:08:48.576>have <00:08:48.731>like <00:08:48.887>four <00:08:49.042>I, <00:08:49.198>um, <00:08:49.353>talk <00:08:49.509>about <00:08:49.665>that.

157
00:08:54.185 --> 00:08:58.685
<00:08:54.185>Uh, <00:08:54.340>if <00:08:54.496>you <00:08:54.651>push <00:08:54.807>it <00:08:54.962>to <00:08:55.118>board <00:08:55.273>to <00:08:55.429>pop <00:08:55.584>security

158
00:09:00.225 --> 00:09:04.605
<00:09:00.225>by <00:09:00.505>default, <00:09:00.785>many <00:09:01.065>containers, <00:09:01.345>um, <00:09:01.625>one

159
00:09:04.625 --> 00:09:05.885
<00:09:04.625>as <00:09:04.908>a <00:09:05.192>privileged <00:09:05.475>route <00:09:05.759>user

160
00:09:05.945 --> 00:09:08.645
<00:09:05.945>and <00:09:06.145>the <00:09:06.345>applications <00:09:06.545>are <00:09:06.745>executed <00:09:06.945>within <00:09:07.145>the <00:09:07.345>container

161
00:09:08.745 --> 00:09:13.005
<00:09:08.745>as <00:09:08.900>route, <00:09:09.056>even <00:09:09.211>though <00:09:09.367>they <00:09:09.522>not <00:09:09.678>require <00:09:09.833>privileged <00:09:09.989>as, <00:09:10.145>uh,

162
00:09:14.195 --> 00:09:16.765
<00:09:14.195>execution, <00:09:14.395>we <00:09:14.595>don't <00:09:14.795>want <00:09:14.995>that <00:09:15.195>to <00:09:15.395>be <00:09:15.595>honest.

163
00:09:18.105 --> 00:09:21.245
<00:09:18.105>So <00:09:18.338>we <00:09:18.571>should <00:09:18.805>create <00:09:19.038>a <00:09:19.271>dedicated <00:09:19.505>user

164
00:09:21.265 --> 00:09:25.845
<00:09:21.265>and <00:09:21.420>coop <00:09:21.576>change <00:09:21.731>to <00:09:21.887>non-wood <00:09:22.042>users <00:09:22.198>with <00:09:22.353>the <00:09:22.509>user <00:09:22.665>directive.

165
00:09:27.715 --> 00:09:30.685
<00:09:27.715>This <00:09:27.855>could <00:09:27.995>look <00:09:28.135>like <00:09:28.275>that, <00:09:28.415>uh, <00:09:28.555>where <00:09:28.695>we <00:09:28.835>create <00:09:28.975>a <00:09:29.115>group

166
00:09:30.745 --> 00:09:33.525
<00:09:30.745>and <00:09:31.025>user <00:09:31.305>set <00:09:31.585>ownership <00:09:31.865>and <00:09:32.145>permissions

167
00:09:33.785 --> 00:09:35.245
<00:09:33.785>and <00:09:34.113>switch <00:09:34.442>to <00:09:34.770>that <00:09:35.099>user

168
00:09:39.165 --> 00:09:41.125
<00:09:39.165>Kubernetes <00:09:39.631>misconfiguration <00:09:40.098>can <00:09:40.564>overweight

169
00:09:41.125 --> 00:09:44.485
<00:09:41.125>that <00:09:41.280>even <00:09:41.436>if <00:09:41.591>we <00:09:41.747>explicitly <00:09:41.902>said <00:09:42.058>that <00:09:42.213>this <00:09:42.369>could <00:09:42.525>be,

170
00:09:44.505 --> 00:09:48.005
<00:09:44.505>for <00:09:44.645>example, <00:09:44.785>if <00:09:44.925>we <00:09:45.064>have <00:09:45.205>it <00:09:45.345>as <00:09:45.485>one <00:09:45.625>user, <00:09:45.765>uh, <00:09:45.905>zero

171
00:09:48.305 --> 00:09:50.645
<00:09:48.305>or <00:09:48.655>we <00:09:49.005>allow <00:09:49.354>with <00:09:49.704>escalation.

172
00:09:51.265 --> 00:09:55.605
<00:09:51.265>If <00:09:51.439>you <00:09:51.615>read <00:09:51.790>things <00:09:51.965>like <00:09:52.140>allow, <00:09:52.314>allow <00:09:52.490>privilege <00:09:52.665>escalation

173
00:09:55.605 --> 00:09:58.245
<00:09:55.605>for <00:09:55.780>a <00:09:55.955>security <00:09:56.130>guide, <00:09:56.305>that's <00:09:56.480>like <00:09:56.655>warning, <00:09:56.830>warning, <00:09:57.005>warning,

174
00:09:58.305 --> 00:10:00.045
<00:09:58.305>no, <00:09:58.479>no, <00:09:58.655>no, <00:09:58.829>no, <00:09:59.005>no, <00:09:59.180>you <00:09:59.354>shouldn't <00:09:59.530>do <00:09:59.704>that.

175
00:10:00.465 --> 00:10:04.525
<00:10:00.465>Uh, <00:10:00.605>but <00:10:00.745>I <00:10:00.885>saw <00:10:01.025>some <00:10:01.165>instances <00:10:01.305>where <00:10:01.445>this <00:10:01.585>was <00:10:01.725>activated, <00:10:01.865>um,

176
00:10:05.035 --> 00:10:06.645
<00:10:05.035>just <00:10:05.268>because <00:10:05.501>you <00:10:05.735>needed <00:10:05.968>to <00:10:06.201>do <00:10:06.435>that,

177
00:10:07.025 --> 00:10:09.485
<00:10:07.025>but <00:10:07.199>then <00:10:07.375>you <00:10:07.550>could <00:10:07.725>have <00:10:07.900>other <00:10:08.074>things <00:10:08.250>in <00:10:08.425>place

178
00:10:09.625 --> 00:10:13.365
<00:10:09.625>to <00:10:09.780>prevent <00:10:09.936>things <00:10:10.091>like <00:10:10.247>that, <00:10:10.402>how <00:10:10.558>to <00:10:10.713>do <00:10:10.869>it <00:10:11.025>right.

179
00:10:13.365 --> 00:10:16.325
<00:10:13.365>In <00:10:13.492>that <00:10:13.619>case, <00:10:13.746>uh, <00:10:13.874>for <00:10:14.001>example, <00:10:14.128>we <00:10:14.255>then <00:10:14.383>wanted <00:10:14.510>as <00:10:14.637>a <00:10:14.765>use

180
00:10:16.325 --> 00:10:20.485
<00:10:16.325>of <00:10:16.465>thousand <00:10:16.605>where <00:10:16.745>we <00:10:16.885>have <00:10:17.025>the <00:10:17.165>privileges, <00:10:17.305>uh, <00:10:17.445>the <00:10:17.585>rights <00:10:17.725>for

181
00:10:20.485 --> 00:10:23.365
<00:10:20.485>that <00:10:20.765>we <00:10:21.045>use, <00:10:21.325>uh, <00:10:21.605>rightfully <00:10:21.885>adjusted,

182
00:10:24.305 --> 00:10:27.605
<00:10:24.305>and <00:10:24.479>also <00:10:24.655>we <00:10:24.829>set, <00:10:25.005>uh, <00:10:25.180>the <00:10:25.354>allow <00:10:25.530>privilege <00:10:25.704>escalation.

183
00:10:27.905 --> 00:10:32.525
<00:10:27.905>Two <00:10:28.605>faults <00:10:29.305>by

184
00:10:32.525 --> 00:10:34.205
<00:10:32.525>default, <00:10:32.991>containers <00:10:33.458>are <00:10:33.925>allowed

185
00:10:34.205 --> 00:10:37.485
<00:10:34.205>to <00:10:34.405>run <00:10:34.605>largely <00:10:34.805>unrestricted <00:10:35.005>within <00:10:35.205>their <00:10:35.405>own <00:10:35.605>context.

186
00:10:39.265 --> 00:10:41.285
<00:10:39.265>We <00:10:39.545>should <00:10:39.824>restrict <00:10:40.105>the <00:10:40.385>file <00:10:40.665>permissions.

187
00:10:42.265 --> 00:10:45.085
<00:10:42.265>Um, <00:10:42.420>this <00:10:42.576>could <00:10:42.731>be <00:10:42.887>done <00:10:43.042>to <00:10:43.198>also <00:10:43.353>the <00:10:43.509>security <00:10:43.665>context

188
00:10:45.415 --> 00:10:47.485
<00:10:45.415>where <00:10:45.648>we <00:10:45.881>can <00:10:46.115>see <00:10:46.348>set <00:10:46.581>the <00:10:46.814>wet.

189
00:10:47.745 --> 00:10:50.645
<00:10:47.745>We <00:10:47.978>only <00:10:48.211>wood <00:10:48.445>file <00:10:48.678>system <00:10:48.911>to <00:10:49.145>two.

190
00:10:54.085 --> 00:10:58.305
<00:10:54.085>Who <00:10:54.285>of <00:10:54.485>you <00:10:54.685>uses <00:10:54.885>our <00:10:55.085>Kubernetes <00:10:55.285>version <00:10:55.485>below

191
00:10:59.485 --> 00:11:00.705
1.25?

192
00:11:03.115 --> 00:11:07.595
<00:11:03.115>I <00:11:03.242>I, <00:11:03.369>I <00:11:03.496>don't <00:11:03.624>think <00:11:03.751>that, <00:11:03.878>I <00:11:04.005>don't <00:11:04.133>think <00:11:04.260>that <00:11:04.387>every <00:11:04.515>one

193
00:11:07.595 --> 00:11:12.515
<00:11:07.595>of <00:11:07.750>you <00:11:07.906>is <00:11:08.061>above <00:11:08.217>1.25, <00:11:08.372>even <00:11:08.528>if <00:11:08.683>like <00:11:08.839>pot, <00:11:08.995>uh,

194
00:11:12.695 --> 00:11:15.555
<00:11:12.695>that's <00:11:12.870>why <00:11:13.045>I <00:11:13.220>asked <00:11:13.395>because <00:11:13.570>pod <00:11:13.745>security <00:11:13.920>policies <00:11:14.095>got

195
00:11:15.845 --> 00:11:18.075
<00:11:15.845>deprecated <00:11:16.195>in <00:11:16.545>the <00:11:16.895>version <00:11:17.245>1.21,

196
00:11:18.485 --> 00:11:20.275
<00:11:18.485>which <00:11:18.765>was <00:11:19.045>like <00:11:19.325>five <00:11:19.605>years <00:11:19.885>ago,

197
00:11:20.275 --> 00:11:21.435
<00:11:20.275>four <00:11:20.483>years <00:11:20.692>ago, <00:11:20.901>things <00:11:21.110>like <00:11:21.319>that.

198
00:11:22.375 --> 00:11:23.715
<00:11:22.375>And <00:11:22.676>I <00:11:22.978>still <00:11:23.279>see <00:11:23.581>many,

199
00:11:23.835 --> 00:11:28.395
<00:11:23.835>many <00:11:24.035>clusters <00:11:24.235>still <00:11:24.435>deployed <00:11:24.635>in <00:11:24.835>versions <00:11:25.035>below <00:11:25.235>1.25.

200
00:11:29.055 --> 00:11:32.595
<00:11:29.055>And <00:11:29.255>it <00:11:29.454>got <00:11:29.655>deprecated <00:11:29.854>in <00:11:30.055>rev <00:11:30.255>version <00:11:30.454>1.21.

201
00:11:33.375 --> 00:11:36.475
<00:11:33.375>Um, <00:11:33.608>and <00:11:33.841>it <00:11:34.075>got <00:11:34.308>removed <00:11:34.541>in <00:11:34.775>1.25,

202
00:11:36.975 --> 00:11:38.675
<00:11:36.975>but <00:11:37.255>I <00:11:37.535>still <00:11:37.815>saw <00:11:38.095>some <00:11:38.375>instances,

203
00:11:38.785 --> 00:11:42.955
<00:11:38.785>some <00:11:38.959>clusters <00:11:39.135>in <00:11:39.310>the <00:11:39.485>past <00:11:39.660>few <00:11:39.834>months <00:11:40.010>in <00:11:40.185>versions.

204
00:11:43.575 --> 00:11:47.395
<00:11:43.575>In <00:11:44.041>that <00:11:44.508>case, <00:11:44.975>Um,

205
00:11:47.735 --> 00:11:49.915
<00:11:47.735>the <00:11:47.968>port <00:11:48.201>security <00:11:48.435>policies, <00:11:48.668>which <00:11:48.901>were <00:11:49.135>prior

206
00:11:49.975 --> 00:11:52.235
<00:11:49.975>to <00:11:50.255>the <00:11:50.535>port <00:11:50.815>security <00:11:51.095>standards, <00:11:51.375>uh,

207
00:11:52.615 --> 00:11:54.765
<00:11:52.615>did <00:11:52.848>control <00:11:53.081>resources <00:11:53.315>at <00:11:53.548>the <00:11:53.781>cluster <00:11:54.015>level

208
00:11:54.905 --> 00:11:57.045
<00:11:54.905>and, <00:11:55.255>uh, <00:11:55.605>PO <00:11:55.954>spec <00:11:56.305>specification.

209
00:11:57.235 --> 00:11:59.885
<00:11:57.235>What <00:11:57.362>we <00:11:57.489>are <00:11:57.616>dealing <00:11:57.744>right <00:11:57.871>now <00:11:57.998>with <00:11:58.125>is <00:11:58.253>that <00:11:58.380>we <00:11:58.507>are <00:11:58.635>working

210
00:11:59.885 --> 00:12:01.645
<00:11:59.885>with <00:12:00.351>pod <00:12:00.818>security <00:12:01.285>standards.

211
00:12:01.655 --> 00:12:05.365
<00:12:01.655>These <00:12:01.829>are <00:12:02.005>defined <00:12:02.180>three <00:12:02.355>standard <00:12:02.530>policies <00:12:02.704>to <00:12:02.880>ensure <00:12:03.055>security

212
00:12:05.625 --> 00:12:06.805
<00:12:05.625>as <00:12:05.979>far <00:12:06.333>as <00:12:06.686>possible.

213
00:12:08.065 --> 00:12:11.845
<00:12:08.065>And <00:12:08.205>we <00:12:08.345>have <00:12:08.485>the <00:12:08.625>pod <00:12:08.765>security <00:12:08.905>a <00:12:09.045>admission, <00:12:09.185>which <00:12:09.325>is, <00:12:09.465>uh,

214
00:12:13.095 --> 00:12:15.245
<00:12:13.095>built <00:12:13.375>in <00:12:13.655>pod <00:12:13.935>security <00:12:14.215>admission <00:12:14.495>controller

215
00:12:15.245 --> 00:12:17.885
<00:12:15.245>to <00:12:15.711>enforce <00:12:16.178>the <00:12:16.645>PSS.

216
00:12:19.455 --> 00:12:20.565
<00:12:19.455>Those <00:12:19.788>look <00:12:20.121>like <00:12:20.454>that.

217
00:12:20.965 --> 00:12:22.085
<00:12:20.965>I <00:12:21.217>won't <00:12:21.469>go <00:12:21.721>into <00:12:21.973>detail

218
00:12:22.115 --> 00:12:24.405
<00:12:22.115>because <00:12:22.395>of <00:12:22.675>the <00:12:22.955>text <00:12:23.235>in <00:12:23.515>regards

219
00:12:24.425 --> 00:12:26.085
<00:12:24.425>of <00:12:24.625>the <00:12:24.824>time <00:12:25.025>we <00:12:25.224>have <00:12:25.425>for <00:12:25.625>this <00:12:25.824>talk.

220
00:12:26.985 --> 00:12:30.245
<00:12:26.985>Um, <00:12:27.218>but <00:12:27.451>those <00:12:27.685>three <00:12:27.918>are <00:12:28.151>privileged, <00:12:28.385>baseline

221
00:12:30.505 --> 00:12:35.045
<00:12:30.505>and <00:12:30.738>restricted <00:12:30.971>also, <00:12:31.205>uh, <00:12:31.438>defined <00:12:31.671>in <00:12:31.905>the

222
00:12:35.765 --> 00:12:36.845
<00:12:35.765>Kubernetes <00:12:36.737>documentation,

223
00:12:39.025 --> 00:12:40.205
<00:12:39.025>but <00:12:39.290>we <00:12:39.556>will <00:12:39.821>go <00:12:40.087>into

224
00:12:40.205 --> 00:12:42.045
<00:12:40.205>that <00:12:40.405>a <00:12:40.605>little <00:12:40.805>bit <00:12:41.005>later <00:12:41.205>with <00:12:41.405>the <00:12:41.605>policies.

225
00:12:43.475 --> 00:12:44.845
<00:12:43.475>Wall <00:12:43.886>based <00:12:44.297>access <00:12:44.708>control.

226
00:12:44.915 --> 00:12:47.285
<00:12:44.915>What <00:12:45.089>is <00:12:45.265>wall <00:12:45.439>based, <00:12:45.615>uh, <00:12:45.790>wall <00:12:45.964>based <00:12:46.140>access <00:12:46.314>control.

227
00:12:47.625 --> 00:12:50.925
<00:12:47.625>We <00:12:47.780>want <00:12:47.936>to <00:12:48.091>ask <00:12:48.247>ourself <00:12:48.402>what <00:12:48.558>can <00:12:48.713>access <00:12:48.869>the <00:12:49.025>cluster?

228
00:12:51.385 --> 00:12:55.485
<00:12:51.385>For <00:12:51.585>example, <00:12:51.785>the <00:12:51.985>user, <00:12:52.185>our <00:12:52.385>applications <00:12:52.585>most <00:12:52.785>times

229
00:12:55.485 --> 00:12:59.845
<00:12:55.485>with <00:12:55.640>a <00:12:55.796>service <00:12:55.951>account <00:12:56.107>and <00:12:56.262>what <00:12:56.418>permissions <00:12:56.573>do <00:12:56.729>they <00:12:56.885>have?

230
00:13:02.355 --> 00:13:03.725
<00:13:02.355>What <00:13:02.663>can <00:13:02.971>the <00:13:03.279>attacker <00:13:03.588>do?

231
00:13:03.985 --> 00:13:06.405
<00:13:03.985>The <00:13:04.218>attacker <00:13:04.451>can <00:13:04.685>also <00:13:04.918>think <00:13:05.151>like <00:13:05.385>that

232
00:13:06.545 --> 00:13:09.405
<00:13:06.545>and <00:13:06.745>see, <00:13:06.944>okay, <00:13:07.145>which <00:13:07.344>applications <00:13:07.545>have <00:13:07.745>which <00:13:07.944>rights?

233
00:13:09.495 --> 00:13:11.325
<00:13:09.495>Which <00:13:09.845>person <00:13:10.195>have <00:13:10.545>which <00:13:10.895>rights,

234
00:13:11.625 --> 00:13:13.285
<00:13:11.625>and <00:13:11.858>use <00:13:12.091>that <00:13:12.325>for <00:13:12.558>their <00:13:12.791>own <00:13:13.025>good

235
00:13:17.195 --> 00:13:18.645
<00:13:17.195>Wall <00:13:17.630>based <00:13:18.065>access <00:13:18.500>controls.

236
00:13:18.985 --> 00:13:21.125
<00:13:18.985>Um, <00:13:19.265>Banes <00:13:19.545>resource <00:13:19.825>that <00:13:20.105>allows <00:13:20.385>you

237
00:13:21.125 --> 00:13:23.205
<00:13:21.125>to <00:13:21.405>regulate <00:13:21.685>access <00:13:21.965>based <00:13:22.245>on <00:13:22.525>walls.

238
00:13:24.465 --> 00:13:26.965
<00:13:24.465>If <00:13:24.665>we <00:13:24.865>look <00:13:25.065>into <00:13:25.265>what <00:13:25.465>can <00:13:25.665>have <00:13:25.865>roles,

239
00:13:27.185 --> 00:13:29.925
<00:13:27.185>we <00:13:27.359>can <00:13:27.535>look <00:13:27.709>at <00:13:27.885>our <00:13:28.060>user <00:13:28.234>in <00:13:28.410>to <00:13:28.584>groups

240
00:13:30.025 --> 00:13:31.205
<00:13:30.025>and <00:13:30.379>to <00:13:30.733>service <00:13:31.087>accounts,

241
00:13:31.745 --> 00:13:34.925
<00:13:31.745>and <00:13:31.978>they <00:13:32.211>are <00:13:32.445>split <00:13:32.678>into <00:13:32.911>two <00:13:33.145>possibilities

242
00:13:34.975 --> 00:13:38.885
<00:13:34.975>where <00:13:35.091>we <00:13:35.208>can <00:13:35.325>give <00:13:35.441>roles <00:13:35.558>as <00:13:35.675>a <00:13:35.791>role <00:13:35.908>and <00:13:36.025>as <00:13:36.141>a <00:13:36.258>cluster <00:13:36.375>role.

243
00:13:40.425 --> 00:13:44.605
<00:13:40.425>Um, <00:13:40.564>for, <00:13:40.704>I <00:13:40.844>have <00:13:40.984>a <00:13:41.125>small <00:13:41.265>checklist <00:13:41.405>in <00:13:41.545>the <00:13:41.685>next <00:13:41.824>slide,

244
00:13:44.705 --> 00:13:47.925
<00:13:44.705>but <00:13:44.938>key <00:13:45.171>privileges <00:13:45.405>as <00:13:45.638>restrictive <00:13:45.871>as <00:13:46.105>possible.

245
00:13:48.825 --> 00:13:51.965
<00:13:48.825>It, <00:13:48.980>it <00:13:49.136>doesn't <00:13:49.291>matter <00:13:49.447>what <00:13:49.602>use <00:13:49.758>case <00:13:49.913>the <00:13:50.069>role <00:13:50.225>has

246
00:13:52.065 --> 00:13:53.445
<00:13:52.065>for <00:13:52.686>this <00:13:53.307>application

247
00:13:53.585 --> 00:13:55.605
<00:13:53.585>or <00:13:53.760>the <00:13:53.935>user <00:13:54.110>for <00:13:54.285>has <00:13:54.460>for <00:13:54.635>this, <00:13:54.810>uh, <00:13:54.985>cluster,

248
00:13:56.225 --> 00:13:59.245
<00:13:56.225>you <00:13:56.400>should <00:13:56.575>always <00:13:56.750>think <00:13:56.925>about <00:13:57.100>what <00:13:57.275>do <00:13:57.450>this <00:13:57.625>user

249
00:13:59.345 --> 00:14:03.685
<00:13:59.345>or <00:13:59.500>service <00:13:59.656>account <00:13:59.811>or <00:13:59.967>the <00:14:00.122>group <00:14:00.278>really <00:14:00.433>needs <00:14:00.589>to <00:14:00.745>do

250
00:14:03.745 --> 00:14:05.885
<00:14:03.745>or <00:14:03.945>which <00:14:04.145>rights <00:14:04.345>to <00:14:04.545>have <00:14:04.745>for <00:14:04.945>this <00:14:05.145>cluster.

251
00:14:09.925 --> 00:14:14.005
<00:14:09.925>A <00:14:10.064>small <00:14:10.204>checklist, <00:14:10.344>uh, <00:14:10.484>I <00:14:10.625>graded <00:14:10.765>for <00:14:10.905>myself <00:14:11.045>if <00:14:11.185>I'm <00:14:11.324>reviewing

252
00:14:14.765 --> 00:14:16.205
<00:14:14.765>anything <00:14:15.197>related <00:14:15.629>to <00:14:16.061>arb.

253
00:14:16.285 --> 00:14:19.165
<00:14:16.285>A <00:14:16.518>in <00:14:16.751>Kubernetes <00:14:16.985>clusters <00:14:17.218>used <00:14:17.451>the <00:14:17.685>principle

254
00:14:19.165 --> 00:14:22.685
<00:14:19.165>of <00:14:19.339>least <00:14:19.515>privilege <00:14:19.689>as <00:14:19.865>I <00:14:20.040>said <00:14:20.214>some <00:14:20.390>seconds <00:14:20.564>ago.

255
00:14:23.545 --> 00:14:26.965
<00:14:23.545>Ask <00:14:23.778>yourself <00:14:24.011>what, <00:14:24.245>uh, <00:14:24.478>whites <00:14:24.711>new <00:14:24.944>use,

256
00:14:27.435 --> 00:14:30.845
<00:14:27.435>what <00:14:27.562>whites <00:14:27.689>do <00:14:27.816>you <00:14:27.944>need <00:14:28.071>to <00:14:28.198>use <00:14:28.325>for <00:14:28.453>this <00:14:28.580>specific <00:14:28.707>use <00:14:28.834>case?

257
00:14:32.255 --> 00:14:34.005
<00:14:32.255>Avoid <00:14:32.605>standard <00:14:32.955>walls <00:14:33.305>and <00:14:33.655>groups.

258
00:14:35.095 --> 00:14:37.805
<00:14:35.095>Permission <00:14:35.295>scope <00:14:35.495>should <00:14:35.695>be <00:14:35.895>at <00:14:36.095>the <00:14:36.295>namespace <00:14:36.495>level.

259
00:14:38.825 --> 00:14:43.525
<00:14:38.825>Do <00:14:39.000>not <00:14:39.175>use <00:14:39.350>wildcards. <00:14:39.525>Use <00:14:39.700>separate <00:14:39.875>rules <00:14:40.050>to <00:14:40.225>apply.

260
00:14:43.555 --> 00:14:46.805
<00:14:43.555>Principle <00:14:43.788>of <00:14:44.021>least <00:14:44.255>privilege <00:14:44.488>to <00:14:44.721>specific <00:14:44.954>resources.

261
00:14:48.045 --> 00:14:51.045
<00:14:48.045>Restrict <00:14:48.324>access <00:14:48.604>to <00:14:48.885>specific <00:14:49.165>resource <00:14:49.444>instances.

262
00:14:52.755 --> 00:14:56.565
<00:14:52.755>Service <00:14:52.910>accounts <00:14:53.066>must <00:14:53.221>not <00:14:53.377>be <00:14:53.532>able <00:14:53.688>to <00:14:53.843>modify <00:14:53.999>our <00:14:54.155>resources,

263
00:14:57.945 --> 00:15:00.645
<00:14:57.945>create <00:14:58.145>a <00:14:58.345>separate <00:14:58.545>service <00:14:58.745>account <00:14:58.945>for <00:14:59.145>each <00:14:59.345>workload.

264
00:15:02.505 --> 00:15:04.605
<00:15:02.505>Do <00:15:02.738>not <00:15:02.971>use <00:15:03.205>the <00:15:03.438>default <00:15:03.671>service <00:15:03.905>account

265
00:15:05.465 --> 00:15:07.765
<00:15:05.465>and <00:15:05.931>no, <00:15:06.398>not <00:15:06.865>lastly,

266
00:15:07.785 --> 00:15:11.045
<00:15:07.785>do <00:15:08.018>not <00:15:08.251>automatically <00:15:08.485>include <00:15:08.718>service <00:15:08.951>account <00:15:09.185>token

267
00:15:11.585 --> 00:15:16.445
<00:15:11.585>and <00:15:11.865>continuously <00:15:12.145>review <00:15:12.425>permissions <00:15:12.705>because <00:15:12.985>just

268
00:15:16.445 --> 00:15:19.565
<00:15:16.445>because <00:15:16.620>it <00:15:16.795>was <00:15:16.970>right <00:15:17.145>today <00:15:17.320>doesn't <00:15:17.495>mean <00:15:17.670>it's <00:15:17.845>right

269
00:15:19.825 --> 00:15:21.445
<00:15:19.825>or <00:15:20.105>secure <00:15:20.385>in <00:15:20.665>the <00:15:20.945>next <00:15:21.225>month.

270
00:15:21.895 --> 00:15:24.045
<00:15:21.895>Maybe <00:15:22.128>something <00:15:22.361>changed <00:15:22.595>in <00:15:22.828>the, <00:15:23.061>your <00:15:23.295>application,

271
00:15:24.045 --> 00:15:25.525
<00:15:24.045>something <00:15:24.311>changed <00:15:24.577>in <00:15:24.844>to <00:15:25.110>your <00:15:25.377>cluster.

272
00:15:25.905 --> 00:15:28.005
<00:15:25.905>We <00:15:26.138>are <00:15:26.371>working <00:15:26.605>in <00:15:26.838>the <00:15:27.071>HR <00:15:27.305>environment

273
00:15:28.125 --> 00:15:30.085
<00:15:28.125>where <00:15:28.405>things <00:15:28.685>change <00:15:28.965>really, <00:15:29.245>really <00:15:29.525>fast.

274
00:15:33.305 --> 00:15:35.485
<00:15:33.305>Now <00:15:33.584>let's <00:15:33.864>jump <00:15:34.145>to <00:15:34.425>network <00:15:34.704>policies.

275
00:15:36.265 --> 00:15:40.205
<00:15:36.265>The <00:15:36.439>communication <00:15:36.615>between <00:15:36.790>pos <00:15:36.965>by <00:15:37.140>default, <00:15:37.314>each <00:15:37.490>port <00:15:37.665>can

276
00:15:40.385 --> 00:15:45.005
<00:15:40.385>to <00:15:40.525>talk, <00:15:40.665>can <00:15:40.805>talk <00:15:40.944>to <00:15:41.085>each <00:15:41.225>other, <00:15:41.365>but <00:15:41.505>in <00:15:41.645>my <00:15:41.785>opinion

277
00:15:45.185 --> 00:15:49.565
<00:15:45.185>and <00:15:45.340>that <00:15:45.496>of <00:15:45.651>many <00:15:45.807>security <00:15:45.962>engineers, <00:15:46.118>not <00:15:46.273>every <00:15:46.429>pod <00:15:46.584>needs

278
00:15:49.565 --> 00:15:51.525
<00:15:49.565>to <00:15:49.765>talk <00:15:49.965>to <00:15:50.165>other, <00:15:50.365>uh, <00:15:50.565>to <00:15:50.765>all <00:15:50.965>others.

279
00:15:53.025 --> 00:15:56.245
<00:15:53.025>So <00:15:53.152>how <00:15:53.279>could <00:15:53.406>we <00:15:53.534>use <00:15:53.661>that <00:15:53.788>or <00:15:53.915>how <00:15:54.043>can <00:15:54.170>we <00:15:54.297>achieve <00:15:54.425>that?

280
00:15:56.265 --> 00:15:57.925
<00:15:56.265>Not <00:15:56.545>every <00:15:56.824>pod <00:15:57.105>talks <00:15:57.385>with <00:15:57.665>everyone.

281
00:15:58.545 --> 00:16:01.685
<00:15:58.545>Um, <00:15:58.719>we <00:15:58.895>should <00:15:59.069>limit <00:15:59.245>the <00:15:59.420>communication <00:15:59.594>with <00:15:59.770>network <00:15:59.944>rules.

282
00:16:06.905 --> 00:16:09.405
<00:16:06.905>We <00:16:07.079>should <00:16:07.255>control <00:16:07.430>traffic <00:16:07.605>flow <00:16:07.780>at <00:16:07.954>the <00:16:08.130>IP <00:16:08.305>address

283
00:16:09.425 --> 00:16:13.805
<00:16:09.425>or <00:16:09.580>port <00:16:09.736>level, <00:16:09.891>uh, <00:16:10.047>which <00:16:10.202>ports <00:16:10.358>can <00:16:10.513>talk <00:16:10.669>to <00:16:10.824>which

284
00:16:15.225 --> 00:16:17.765
<00:16:15.225>and <00:16:15.425>which <00:16:15.625>ports <00:16:15.825>they <00:16:16.025>can <00:16:16.225>receive <00:16:16.425>traffic <00:16:16.625>from.

285
00:16:20.555 --> 00:16:22.685
<00:16:20.555>Example, <00:16:20.710>we <00:16:20.866>have <00:16:21.021>a <00:16:21.177>front <00:16:21.332>end, <00:16:21.488>we <00:16:21.643>have <00:16:21.799>a <00:16:21.954>backend

286
00:16:22.685 --> 00:16:23.725
<00:16:22.685>and <00:16:22.919>we <00:16:23.153>have <00:16:23.387>a <00:16:23.621>database.

287
00:16:25.745 --> 00:16:28.725
<00:16:25.745>Now <00:16:25.920>we <00:16:26.095>should <00:16:26.270>AP <00:16:26.445>apply <00:16:26.620>list <00:16:26.795>access <00:16:26.970>allowed <00:16:27.145>rules.

288
00:16:29.945 --> 00:16:32.365
<00:16:29.945>The <00:16:30.145>front <00:16:30.345>end <00:16:30.545>should <00:16:30.745>talk <00:16:30.945>to <00:16:31.145>the <00:16:31.345>backend

289
00:16:32.385 --> 00:16:35.485
<00:16:32.385>and <00:16:32.585>the <00:16:32.785>backend <00:16:32.985>should <00:16:33.185>talk <00:16:33.385>to <00:16:33.585>the <00:16:33.785>database.

290
00:16:36.065 --> 00:16:37.925
<00:16:36.065>But <00:16:36.240>what <00:16:36.415>we <00:16:36.590>don't <00:16:36.765>want <00:16:36.940>to <00:16:37.115>do <00:16:37.290>have <00:16:37.465>is

291
00:16:38.195 --> 00:16:41.325
<00:16:38.195>that <00:16:38.335>the <00:16:38.475>front <00:16:38.615>end <00:16:38.755>maybe <00:16:38.895>can <00:16:39.035>talk <00:16:39.175>directly <00:16:39.315>to <00:16:39.455>the <00:16:39.595>database.

292
00:16:42.105 --> 00:16:46.725
<00:16:42.105>Um, <00:16:42.245>so <00:16:42.385>we <00:16:42.525>could, <00:16:42.665>um, <00:16:42.805>achieve <00:16:42.945>that <00:16:43.085>with <00:16:43.225>the <00:16:43.365>privacy, <00:16:43.505>uh,

293
00:16:46.835 --> 00:16:47.885
<00:16:46.835>information <00:16:47.307>we <00:16:47.780>have.

294
00:16:50.105 --> 00:16:51.725
<00:16:50.105>In <00:16:50.385>that <00:16:50.665>case, <00:16:50.945>use <00:16:51.225>our <00:16:51.505>CNI.

295
00:16:52.105 --> 00:16:54.885
<00:16:52.105>Uh, <00:16:52.305>CNI <00:16:52.505>stands <00:16:52.705>for <00:16:52.905>container <00:16:53.105>network <00:16:53.305>interface <00:16:53.505>plugin

296
00:16:54.995 --> 00:16:56.405
<00:16:54.995>that <00:16:55.312>uses <00:16:55.629>the <00:16:55.946>network <00:16:56.264>policy.

297
00:16:56.805 --> 00:16:59.765
<00:16:56.805>API. <00:16:57.038>This <00:16:57.271>could, <00:16:57.505>for <00:16:57.738>example, <00:16:57.971>be <00:16:58.204>done

298
00:16:59.865 --> 00:17:01.805
<00:16:59.865>to <00:17:00.331>Calico <00:17:00.798>or <00:17:01.265>wavenet.

299
00:17:03.185 --> 00:17:05.805
<00:17:03.185>And <00:17:03.340>one <00:17:03.496>thing <00:17:03.651>I <00:17:03.807>want <00:17:03.962>to <00:17:04.118>add <00:17:04.273>to <00:17:04.429>that <00:17:04.585>is

300
00:17:06.445 --> 00:17:09.965
<00:17:06.444>creating <00:17:06.678>a <00:17:06.911>network <00:17:07.145>policy <00:17:07.378>resource <00:17:07.611>without <00:17:07.845>controller,

301
00:17:09.995 --> 00:17:11.405
<00:17:09.994>that <00:17:10.417>without <00:17:10.840>a <00:17:11.263>controller

302
00:17:11.405 --> 00:17:13.605
<00:17:11.405>that <00:17:11.638>implements <00:17:11.871>it <00:17:12.105>will <00:17:12.338>have <00:17:12.571>no <00:17:12.805>effect

303
00:17:16.115 --> 00:17:17.815
<00:17:16.115>or <00:17:16.581>you <00:17:17.048>service <00:17:17.515>mesh.

304
00:17:17.815 --> 00:17:19.575
<00:17:17.815>But <00:17:18.095>that's <00:17:18.375>a <00:17:18.655>whole <00:17:18.935>different <00:17:19.215>story

305
00:17:19.635 --> 00:17:22.775
<00:17:19.635>and <00:17:19.775>it <00:17:19.915>doesn't <00:17:20.055>have <00:17:20.194>that <00:17:20.335>much, <00:17:20.474>uh, <00:17:20.615>space <00:17:20.754>for <00:17:20.895>this <00:17:21.035>talk.

306
00:17:23.555 --> 00:17:25.375
<00:17:23.555>But <00:17:23.788>if <00:17:24.021>you <00:17:24.255>use <00:17:24.488>this <00:17:24.721>service <00:17:24.955>mesh,

307
00:17:25.475 --> 00:17:28.775
<00:17:25.474>you <00:17:25.675>could <00:17:25.875>also <00:17:26.074>use <00:17:26.274>ML <00:17:26.474>MTLS <00:17:26.675>by <00:17:26.875>default.

308
00:17:29.635 --> 00:17:31.615
<00:17:29.635>As <00:17:29.985>we <00:17:30.335>said <00:17:30.685>earlier, <00:17:31.035>everything,

309
00:17:32.095 --> 00:17:33.695
<00:17:32.095>everyone <00:17:32.445>can <00:17:32.795>talk <00:17:33.145>with <00:17:33.495>anyone.

310
00:17:34.195 --> 00:17:36.855
<00:17:34.195>Um, <00:17:34.475>communication <00:17:34.754>between <00:17:35.034>POS <00:17:35.314>is <00:17:35.595>unencrypted.

311
00:17:38.095 --> 00:17:39.295
<00:17:38.095>MTLS <00:17:38.455>could <00:17:38.815>be <00:17:39.175>done.

312
00:17:39.675 --> 00:17:41.775
<00:17:39.675>And <00:17:39.875>then <00:17:40.075>we <00:17:40.274>have <00:17:40.475>like <00:17:40.675>a <00:17:40.875>transport <00:17:41.075>layers

313
00:17:42.575 --> 00:17:45.655
<00:17:42.575>security <00:17:42.750>layer <00:17:42.925>used <00:17:43.100>in <00:17:43.275>our <00:17:43.450>communication <00:17:43.625>with <00:17:43.800>the <00:17:43.975>parts.

314
00:17:46.195 --> 00:17:49.565
<00:17:46.195>Um, <00:17:46.350>only <00:17:46.506>service, <00:17:46.661>uh, <00:17:46.817>only <00:17:46.972>working <00:17:47.128>with <00:17:47.283>service <00:17:47.439>mesh, <00:17:47.595>uh,

315
00:17:49.965 --> 00:17:52.525
<00:17:49.965>possibly <00:17:51.365>ETCD.

316
00:17:54.105 --> 00:17:58.365
<00:17:54.105>The <00:17:54.280>ETCD, <00:17:54.455>um, <00:17:54.630>has, <00:17:54.805>um, <00:17:54.980>has <00:17:55.155>all <00:17:55.330>our <00:17:55.505>secret

317
00:17:58.465 --> 00:18:00.165
<00:17:58.465>and <00:17:58.814>all <00:17:59.165>our <00:17:59.514>Kubernetes <00:17:59.865>security

318
00:18:00.585 --> 00:18:03.445
<00:18:00.585>and <00:18:00.865>not <00:18:01.145>Kubernetes <00:18:01.425>security, <00:18:01.705>Kubernetes <00:18:01.985>configurations,

319
00:18:03.955 --> 00:18:07.125
<00:18:03.955>data <00:18:04.655>stored <00:18:05.355>and

320
00:18:09.015 --> 00:18:11.475
<00:18:09.015>the <00:18:09.215>baking <00:18:09.415>store <00:18:09.615>for <00:18:09.815>all <00:18:10.015>our <00:18:10.215>cluster <00:18:10.415>data.

321
00:18:13.085 --> 00:18:17.235
<00:18:13.085>Every <00:18:13.365>single <00:18:13.645>update <00:18:13.925>gets <00:18:14.205>saved <00:18:14.485>into,

322
00:18:17.735 --> 00:18:19.075
<00:18:17.735>uh, <00:18:18.338>our <00:18:18.941>ETCD.

323
00:18:19.335 --> 00:18:21.195
<00:18:19.335>I'm <00:18:19.510>missing <00:18:19.685>the <00:18:19.860>D <00:18:20.035>here, <00:18:20.210>but <00:18:20.385>that's <00:18:20.560>not <00:18:20.735>the,

324
00:18:21.715 --> 00:18:23.595
<00:18:21.715>I <00:18:21.870>think <00:18:22.026>you're <00:18:22.181>getting <00:18:22.337>what <00:18:22.492>I <00:18:22.648>wanted <00:18:22.803>to <00:18:22.959>say <00:18:23.115>here.

325
00:18:24.335 --> 00:18:28.355
<00:18:24.335>Any <00:18:24.535>changes <00:18:24.735>directly <00:18:24.935>to, <00:18:25.135>into <00:18:25.335>the <00:18:25.535>ETD <00:18:25.735>leads

326
00:18:28.415 --> 00:18:30.475
<00:18:28.415>to <00:18:28.695>changes <00:18:28.975>in <00:18:29.254>the <00:18:29.534>whole <00:18:29.815>cluster.

327
00:18:32.935 --> 00:18:36.235
<00:18:32.935>If <00:18:33.110>we're <00:18:33.284>now <00:18:33.460>switching <00:18:33.635>to <00:18:33.810>our <00:18:33.985>attacker <00:18:34.159>perspective <00:18:34.335>again,

328
00:18:36.745 --> 00:18:41.555
<00:18:36.745>then <00:18:36.900>we <00:18:37.056>could <00:18:37.211>look, <00:18:37.367>okay, <00:18:37.522>that <00:18:37.678>is <00:18:37.833>really, <00:18:37.989>really <00:18:38.145>bad.

329
00:18:42.465 --> 00:18:44.755
<00:18:42.465>Unlimited <00:18:42.698>access <00:18:42.931>to <00:18:43.165>the <00:18:43.398>cluster, <00:18:43.631>uh, <00:18:43.865>cluster

330
00:18:44.755 --> 00:18:48.235
<00:18:44.755>because <00:18:44.955>the <00:18:45.155>attacker <00:18:45.355>can <00:18:45.555>then <00:18:45.755>bypass <00:18:45.955>the <00:18:46.155>API

331
00:18:48.235 --> 00:18:49.515
<00:18:48.235>server <00:18:48.465>and <00:18:48.695>we <00:18:48.926>don't <00:18:49.156>want <00:18:49.387>that.

332
00:18:49.775 --> 00:18:52.595
<00:18:49.775>And <00:18:49.915>that's <00:18:50.055>the <00:18:50.195>attacker <00:18:50.335>that <00:18:50.475>is <00:18:50.615>like <00:18:50.755>a <00:18:50.895>gold <00:18:51.035>gold <00:18:51.175>mine

333
00:18:52.815 --> 00:18:54.315
<00:18:52.815>for <00:18:54.165>us.

334
00:18:55.375 --> 00:18:56.715
<00:18:55.375>So <00:18:55.616>how <00:18:55.857>could <00:18:56.098>we <00:18:56.339>secure <00:18:56.581>it?

335
00:18:57.175 --> 00:19:01.155
<00:18:57.175>Um, <00:18:57.375>the <00:18:57.575>ETCD <00:18:57.774>server <00:18:57.975>should <00:18:58.175>only <00:18:58.375>trust <00:18:58.575>the

336
00:19:01.795 --> 00:19:05.555
<00:19:01.795>certificate <00:19:01.950>assigned <00:19:02.106>to <00:19:02.261>the <00:19:02.417>API <00:19:02.572>server <00:19:02.728>can <00:19:02.883>one <00:19:03.039>on <00:19:03.195>a

337
00:19:06.315 --> 00:19:07.595
<00:19:06.315>separate <00:19:06.699>control <00:19:07.083>play <00:19:07.467>node,

338
00:19:08.575 --> 00:19:12.595
<00:19:08.575>and <00:19:08.808>uh, <00:19:09.041>it <00:19:09.275>should <00:19:09.508>be <00:19:09.741>established <00:19:09.975>TTPS

339
00:19:12.745 --> 00:19:14.155
<00:19:12.745>between <00:19:13.379>ETCT <00:19:14.014>server

340
00:19:14.335 --> 00:19:17.955
<00:19:14.335>and <00:19:14.685>API <00:19:15.035>server <00:19:15.385>using <00:19:15.735>a

341
00:19:18.115 --> 00:19:19.355
<00:19:18.115>separate <00:19:19.231>certification.

342
00:19:19.495 --> 00:19:22.795
<00:19:19.495>Uh, <00:19:19.650>certificate <00:19:19.806>authority <00:19:19.961>for <00:19:20.117>ET <00:19:20.272>CT <00:19:20.428>can <00:19:20.583>also <00:19:20.739>be <00:19:20.895>beneficial

343
00:19:23.255 --> 00:19:27.035
<00:19:23.255>as <00:19:23.410>it <00:19:23.566>was <00:19:23.721>all <00:19:23.877>certificates <00:19:24.032>issued <00:19:24.188>by <00:19:24.343>the <00:19:24.499>wood <00:19:24.655>ca

344
00:19:31.435 --> 00:19:32.235
<00:19:31.435>security <00:19:32.155>policies.

345
00:19:32.655 --> 00:19:36.355
<00:19:32.655>So <00:19:32.795>we <00:19:32.935>talked <00:19:33.075>about <00:19:33.215>many <00:19:33.355>stuff <00:19:33.495>in <00:19:33.635>the <00:19:33.774>last <00:19:33.915>few <00:19:34.055>minutes,

346
00:19:37.335 --> 00:19:38.995
<00:19:37.335>and <00:19:37.615>I <00:19:37.895>want <00:19:38.175>to <00:19:38.455>automate <00:19:38.735>it

347
00:19:38.995 --> 00:19:41.275
<00:19:38.995>because <00:19:39.228>I <00:19:39.461>can't <00:19:39.695>control <00:19:39.928>that <00:19:40.161>at <00:19:40.395>scale

348
00:19:41.935 --> 00:19:45.035
<00:19:41.935>as <00:19:42.090>a <00:19:42.246>security <00:19:42.401>engineer, <00:19:42.557>I <00:19:42.712>could <00:19:42.868>use <00:19:43.023>tools <00:19:43.179>for <00:19:43.335>example,

349
00:19:45.065 --> 00:19:47.275
<00:19:45.065>like <00:19:45.345>these <00:19:45.625>three <00:19:45.905>q <00:19:46.185>broaden <00:19:46.465>qo

350
00:19:47.455 --> 00:19:49.435
<00:19:47.455>or <00:19:47.688>the <00:19:47.921>open <00:19:48.155>gatekeeper <00:19:48.388>to <00:19:48.621>help <00:19:48.855>me

351
00:19:50.305 --> 00:19:52.555
<00:19:50.305>implement <00:19:50.771>those <00:19:51.238>security <00:19:51.705>policies.

352
00:19:55.655 --> 00:20:00.155
<00:19:55.655>How <00:19:55.830>does <00:19:56.004>that <00:19:56.180>work? <00:19:56.355>It <00:19:56.530>doesn't <00:19:56.705>matter <00:19:56.879>where <00:19:57.055>the,

353
00:20:00.215 --> 00:20:03.435
<00:20:00.215>is <00:20:00.331>if <00:20:00.448>a <00:20:00.564>user, <00:20:00.681>if <00:20:00.798>it's <00:20:00.915>a <00:20:01.031>service <00:20:01.148>account, <00:20:01.264>if <00:20:01.381>it's <00:20:01.498>a <00:20:01.615>group,

354
00:20:03.785 --> 00:20:05.275
<00:20:03.785>it's <00:20:04.053>getting <00:20:04.321>to <00:20:04.589>the <00:20:04.857>API <00:20:05.126>server

355
00:20:05.695 --> 00:20:09.675
<00:20:05.695>and <00:20:05.850>inside <00:20:06.006>the <00:20:06.161>API <00:20:06.317>server, <00:20:06.472>we <00:20:06.628>have <00:20:06.783>the <00:20:06.939>admission <00:20:07.095>controller.

356
00:20:11.575 --> 00:20:13.915
<00:20:11.575>For <00:20:11.715>example, <00:20:11.855>here, <00:20:11.995>we <00:20:12.135>could <00:20:12.275>use <00:20:12.415>one <00:20:12.555>of <00:20:12.695>those <00:20:12.835>three <00:20:12.975>tools

357
00:20:14.575 --> 00:20:16.435
<00:20:14.575>and <00:20:15.275>ask <00:20:15.975>ourselves

358
00:20:17.455 --> 00:20:20.635
<00:20:17.455>or <00:20:17.688>the <00:20:17.921>cluster, <00:20:18.155>okay, <00:20:18.388>is <00:20:18.621>this <00:20:18.855>allowed

359
00:20:20.855 --> 00:20:21.915
<00:20:20.855>or <00:20:21.093>is <00:20:21.331>this <00:20:21.570>not <00:20:21.809>allowed?

360
00:20:22.975 --> 00:20:25.155
<00:20:22.975>And <00:20:23.208>you <00:20:23.441>can <00:20:23.675>do <00:20:23.908>this <00:20:24.141>very <00:20:24.375>granularly.

361
00:20:25.895 --> 00:20:28.955
<00:20:25.895>And <00:20:26.070>then <00:20:26.245>with <00:20:26.420>the <00:20:26.595>admission <00:20:26.770>controller, <00:20:26.945>it <00:20:27.120>answers, <00:20:27.295>okay,

362
00:20:29.225 --> 00:20:30.675
<00:20:29.225>it's <00:20:29.551>good, <00:20:29.877>it's <00:20:30.203>not <00:20:30.530>good.

363
00:20:31.155 --> 00:20:32.715
<00:20:31.155>I <00:20:31.355>don't <00:20:31.555>know, <00:20:31.754>maybe <00:20:31.955>I <00:20:32.155>need <00:20:32.355>your <00:20:32.555>help.

364
00:20:33.255 --> 00:20:37.155
<00:20:33.255>Um, <00:20:33.395>and <00:20:33.535>you <00:20:33.675>can <00:20:33.815>accept <00:20:33.955>it <00:20:34.095>or <00:20:34.235>you <00:20:34.375>can <00:20:34.515>deny <00:20:34.655>it.

365
00:20:42.905 --> 00:20:47.325
<00:20:42.905>Now, <00:20:43.045>I <00:20:43.185>got <00:20:43.325>done <00:20:43.465>also <00:20:43.605>really <00:20:43.745>fast, <00:20:43.885>even <00:20:44.024>if <00:20:44.165>I <00:20:44.305>said

366
00:20:47.325 --> 00:20:49.965
<00:20:47.325>to <00:20:47.558>all <00:20:47.791>the, <00:20:48.025>uh, <00:20:48.258>organization <00:20:48.491>people <00:20:48.725>here

367
00:20:49.965 --> 00:20:52.165
<00:20:49.965>that <00:20:50.198>I <00:20:50.431>won't <00:20:50.665>take <00:20:50.898>too <00:20:51.131>much <00:20:51.365>time,

368
00:20:52.705 --> 00:20:56.725
<00:20:52.705>but, <00:20:52.879>um, <00:20:53.054>let's <00:20:53.230>just <00:20:53.405>get <00:20:53.580>to <00:20:53.754>the <00:20:53.929>key <00:20:54.105>takeaways.

369
00:20:58.755 --> 00:21:02.445
<00:20:58.755>What <00:20:58.930>can <00:20:59.105>we <00:20:59.280>do <00:20:59.455>to <00:20:59.630>harden <00:20:59.805>our <00:20:59.980>Kubernetes <00:21:00.155>cloud?

370
00:21:02.505 --> 00:21:04.445
<00:21:02.505>Uh, <00:21:02.738>how <00:21:02.971>to <00:21:03.205>secure <00:21:03.438>our <00:21:03.671>KU <00:21:03.905>cluster?

371
00:21:04.715 --> 00:21:06.765
<00:21:04.715>There's <00:21:04.948>so, <00:21:05.181>so <00:21:05.415>much <00:21:05.648>thing <00:21:05.881>to <00:21:06.115>do,

372
00:21:07.185 --> 00:21:08.365
<00:21:07.185>and <00:21:07.397>I <00:21:07.609>was <00:21:07.822>thinking <00:21:08.034>like, <00:21:08.247>okay,

373
00:21:08.465 --> 00:21:12.005
<00:21:08.465>how <00:21:08.620>can <00:21:08.776>I <00:21:08.931>get <00:21:09.087>a <00:21:09.242>really <00:21:09.398>good <00:21:09.553>grasp <00:21:09.709>into <00:21:09.865>how

374
00:21:12.005 --> 00:21:13.725
<00:21:12.005>to <00:21:12.238>secure <00:21:12.471>it <00:21:12.705>in <00:21:12.938>a <00:21:13.171>holistic <00:21:13.405>way?

375
00:21:14.225 --> 00:21:17.765
<00:21:14.225>But <00:21:14.365>as <00:21:14.504>we <00:21:14.645>all <00:21:14.784>know, <00:21:14.925>Kubernetes <00:21:15.064>is <00:21:15.205>all <00:21:15.344>already <00:21:15.485>a <00:21:15.625>really,

376
00:21:17.765 --> 00:21:20.525
<00:21:17.765>really <00:21:17.965>complex <00:21:18.165>infrastructure <00:21:18.365>we <00:21:18.565>are <00:21:18.765>building <00:21:18.965>for <00:21:19.165>ourselves.

377
00:21:21.025 --> 00:21:23.605
<00:21:21.025>So <00:21:21.165>I <00:21:21.305>wanted <00:21:21.445>to <00:21:21.585>have <00:21:21.725>like <00:21:21.865>a <00:21:22.005>holistic <00:21:22.145>view <00:21:22.285>on <00:21:22.425>it.

378
00:21:23.865 --> 00:21:25.525
<00:21:23.865>Um, <00:21:24.098>just <00:21:24.331>a <00:21:24.565>tip <00:21:24.798>of <00:21:25.031>the <00:21:25.265>iceberg.

379
00:21:25.545 --> 00:21:28.925
<00:21:25.545>But <00:21:25.685>of <00:21:25.825>course <00:21:25.965>there's <00:21:26.105>many <00:21:26.245>things <00:21:26.385>we <00:21:26.525>could <00:21:26.665>deep <00:21:26.805>dive <00:21:26.945>into.

380
00:21:29.505 --> 00:21:34.445
<00:21:29.505>But <00:21:29.680>let's <00:21:29.855>take <00:21:30.030>some <00:21:30.205>key <00:21:30.380>takeaways <00:21:30.555>for <00:21:30.730>this <00:21:30.905>presentation.

381
00:21:34.905 --> 00:21:39.005
<00:21:34.905>We <00:21:35.045>want <00:21:35.185>to <00:21:35.325>have <00:21:35.465>hardened <00:21:35.605>images <00:21:35.745>where <00:21:35.885>we <00:21:36.024>use <00:21:36.165>trusted <00:21:36.305>sources

382
00:21:39.625 --> 00:21:41.045
<00:21:39.625>on <00:21:40.051>scan <00:21:40.477>for <00:21:40.903>vulnerabilities.

383
00:21:43.985 --> 00:21:45.245
<00:21:43.985>We <00:21:44.268>want <00:21:44.552>to <00:21:44.835>avoid <00:21:45.119>root.

384
00:21:46.105 --> 00:21:49.365
<00:21:46.105>We <00:21:46.260>want <00:21:46.416>the <00:21:46.571>containers <00:21:46.727>as <00:21:46.882>non-wood <00:21:47.038>locked <00:21:47.193>down, <00:21:47.349>for <00:21:47.505>example.

385
00:21:49.435 --> 00:21:51.365
<00:21:49.435>Also <00:21:49.635>the <00:21:49.835>file <00:21:50.034>systems, <00:21:50.235>because <00:21:50.435>there <00:21:50.635>could <00:21:50.835>be

386
00:21:51.365 --> 00:21:52.685
<00:21:51.365>underlying <00:21:51.761>problems <00:21:52.157>with <00:21:52.553>that.

387
00:21:54.225 --> 00:21:56.525
<00:21:54.225>We <00:21:54.399>want <00:21:54.574>to <00:21:54.750>use <00:21:54.925>the <00:21:55.100>principle <00:21:55.274>of <00:21:55.449>lease <00:21:55.625>privilege.

388
00:21:57.425 --> 00:22:02.325
<00:21:57.425>We <00:21:57.552>want <00:21:57.679>to <00:21:57.806>have <00:21:57.934>tight <00:21:58.061>air <00:21:58.188>bug, <00:21:58.315>uh, <00:21:58.443>policies <00:21:58.570>where <00:21:58.697>we <00:21:58.825>all

389
00:22:02.835 --> 00:22:04.365
<00:22:02.835>only <00:22:03.294>give <00:22:03.753>the <00:22:04.212>information

390
00:22:04.705 --> 00:22:07.445
<00:22:04.705>or <00:22:04.905>the, <00:22:05.105>sorry, <00:22:05.304>not <00:22:05.504>the <00:22:05.705>information, <00:22:05.905>the <00:22:06.105>permission,

391
00:22:07.875 --> 00:22:10.885
<00:22:07.875>what <00:22:08.050>the <00:22:08.225>people <00:22:08.400>or <00:22:08.575>the <00:22:08.750>use <00:22:08.925>or <00:22:09.100>the <00:22:09.275>application

392
00:22:11.185 --> 00:22:12.925
<00:22:11.185>or <00:22:11.465>the <00:22:11.745>container <00:22:12.024>needs <00:22:12.304>really <00:22:12.585>do.

393
00:22:13.265 --> 00:22:15.365
<00:22:13.265>And <00:22:13.498>we <00:22:13.731>need <00:22:13.965>to <00:22:14.198>order <00:22:14.431>that <00:22:14.665>regularly.

394
00:22:16.905 --> 00:22:21.765
<00:22:16.905>We <00:22:17.045>should <00:22:17.185>isolate <00:22:17.325>the <00:22:17.465>traffic, <00:22:17.605>uh, <00:22:17.745>limit <00:22:17.885>PO <00:22:18.024>to <00:22:18.165>PO <00:22:18.305>access,

395
00:22:21.905 --> 00:22:23.605
<00:22:21.905>for <00:22:22.254>example, <00:22:22.605>with <00:22:22.955>network <00:22:23.305>policies.

396
00:22:24.305 --> 00:22:27.725
<00:22:24.305>And <00:22:24.538>we <00:22:24.771>should <00:22:25.005>protect <00:22:25.238>the <00:22:25.471>ETCD, <00:22:25.705>um,

397
00:22:28.545 --> 00:22:31.365
<00:22:28.545>secure <00:22:28.745>secret <00:22:28.945>store <00:22:29.145>with <00:22:29.345>TLS <00:22:29.545>and <00:22:29.745>access <00:22:29.945>control.

398
00:22:32.635 --> 00:22:35.525
<00:22:32.635>Also, <00:22:32.868>we <00:22:33.101>should <00:22:33.335>automate <00:22:33.568>our <00:22:33.801>security <00:22:34.035>policies

399
00:22:35.985 --> 00:22:39.445
<00:22:35.985>and <00:22:36.140>force <00:22:36.296>our <00:22:36.451>rules, <00:22:36.607>for <00:22:36.762>example, <00:22:36.918>with <00:22:37.073>these <00:22:37.229>three <00:22:37.385>tools.

400
00:22:39.985 --> 00:22:43.405
<00:22:39.985>Um, <00:22:40.125>I <00:22:40.264>did <00:22:40.405>really <00:22:40.544>good <00:22:40.685>experience <00:22:40.824>with <00:22:40.965>all <00:22:41.104>three <00:22:41.245>of <00:22:41.385>them,

401
00:22:45.385 --> 00:22:48.645
<00:22:45.385>and <00:22:45.540>you, <00:22:45.696>as <00:22:45.851>I <00:22:46.007>said, <00:22:46.162>you <00:22:46.318>could <00:22:46.473>do <00:22:46.629>even <00:22:46.785>more.

402
00:22:49.275 --> 00:22:51.245
<00:22:49.275>There's <00:22:49.475>so <00:22:49.675>much <00:22:49.875>things <00:22:50.075>you <00:22:50.275>can <00:22:50.475>do <00:22:50.675>in

403
00:22:51.245 --> 00:22:52.765
<00:22:51.245>the <00:22:51.701>Kubernetes <00:22:52.157>security <00:22:52.613>world.

404
00:22:53.145 --> 00:22:56.245
<00:22:53.145>The <00:22:53.425>documentation <00:22:53.705>for <00:22:53.985>the <00:22:54.264>security, <00:22:54.545>um,

405
00:22:56.395 --> 00:22:59.885
<00:22:56.395>it's <00:22:56.595>really <00:22:56.795>good <00:22:56.995>at <00:22:57.195>the <00:22:57.395>Kubernetes <00:22:57.595>IO <00:22:57.795>documentation.

406
00:23:00.865 --> 00:23:05.245
<00:23:00.865>Um, <00:23:01.005>so <00:23:01.145>give <00:23:01.285>that <00:23:01.425>a <00:23:01.565>read <00:23:01.705>and <00:23:01.845>they <00:23:01.985>dive <00:23:02.125>into <00:23:02.265>that.