Aqua Blog

Kubernetes Security

2022 Cloud Native Threat Report: Key Trends in Cyber Attacks

2022 Cloud Native Threat Report: Key Trends in Cyber Attacks

As companies continue to adopt cloud native technologies at a rapid pace, an increasing number of cyber threats are targeting the cloud native environment. To defend against these threats, security practitioners must stay abreast of attackers’ evolving tactics, techniques, and procedures. For its 2022 Cloud Native …

Continue reading ›
Kubernetes RBAC: How to Avoid Privilege Escalation via Certificate Signing

Kubernetes RBAC: How to Avoid Privilege Escalation via Certificate Signing

Following on from our previous post on the risks of privilege escalation in Kubernetes via the node/proxy resource, we’re going to take a look at how users who have rights to the certificate signing request (CSR) API in Kubernetes might be able to use them to escalate their privileges in a cluster. In addition to …

Continue reading ›
Privilege Escalation from Node/Proxy Rights in Kubernetes RBAC

Privilege Escalation from Node/Proxy Rights in Kubernetes RBAC

One of the side effects of Kubernetes’ rich API and extensive functionality is that sometimes there are security implications to granting users permissions. Security architects should be aware of these side effects when designing platforms that use Kubernetes. In recent research with Iain Smart of NCC Group, we looked …

Continue reading ›
Adopting Zero Trust in Kubernetes: The Fundamentals

Adopting Zero Trust in Kubernetes: The Fundamentals

In late January, the White House published a memo that lays the groundwork for creating a zero-trust architecture for federal agencies. With renewed attention from the US government, zero-trust networking is an area that many organizations are focusing on to improve their security posture. With that focus, it makes …

Continue reading ›
RBAC Virtual Verbs: Teaching Kubernetes to Educate Dolphins

RBAC Virtual Verbs: Teaching Kubernetes to Educate Dolphins

Kubernetes’ role-based access control (RBAC) system is a cornerstone of cluster security. Most clusters use RBAC to determine which users have access to specific operations, and its core elements are well covered in the Kubernetes documentation. However, there are some less well-known features that could be relevant …

Continue reading ›
CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes

CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes

Last week, a new high-severity CVE was released that affects the Linux kernel. This vulnerability provides an opportunity for an attacker who has access to a system as an unprivileged user to escalate those rights to root. To do this, the attacker must have a specific Linux capability, CAP_SYS_ADMIN, which reduces the …

Continue reading ›
Protecting Cloud Native Workloads on GKE Autopilot

Protecting Cloud Native Workloads on GKE Autopilot

GKE Autopilot is a new mode of operation in Google Kubernetes Engine (GKE) launched earlier this year to help DevOps teams focus their time and resources on building applications on Kubernetes, rather than on managing the infrastructure that the applications run on. As Aqua Security is a GKE selected security partner, …

Continue reading ›
Kubernetes Version 1.23: What's New for Security? 

Kubernetes Version 1.23: What's New for Security? 

Like clockwork, a new Kubernetes release is upon us, with loads of interesting new features. A couple of the key features in Kubernetes 1.23 are hitting the beta level and will be enabled by default. In this post, we’ll explain what they mean for security, both in terms of improving cluster security and what you need …

Continue reading ›
RATs in the Cloud: Kubernetes UI Tools Turn into a Weapon

RATs in the Cloud: Kubernetes UI Tools Turn into a Weapon

For many years, threat actors have been using legitimate remote access tools (RATs) in their campaigns, tricking users into installing them to get full control over the victims’ systems. Similarly, in the cloud native world, attackers are increasingly targeting user interface (UI) tools to gain access to Docker and …

Continue reading ›
Key Takeaways From KubeSec: Our 6th Enterprise Summit for K8s Security

Key Takeaways From KubeSec: Our 6th Enterprise Summit for K8s Security

This month, the KubeSec Enterprise vSummit brought together hundreds of DevOps and security practitioners to discuss the state of cloud native security and share best practices. As with previous events, the focus was on enterprise experiences in securing real-world deployments involving containers, Kubernetes, …

Continue reading ›
Tracee Runtime Security Series: Easy Installation on Kubernetes

Tracee Runtime Security Series: Easy Installation on Kubernetes

Despite best efforts to harden Kubernetes environments, prevention will never be enough and attackers are finding ways to evade shift-left and other preventative capabilities. It is critical to be able to detect and respond in real time to attacks within Kubernetes clusters. Tracee, an open source runtime security …

Continue reading ›