Six Common Security Weaknesses of Kubernetes and AWS

During the last two years, we conducted circa fifty security assessments (largely named penetration testing engagements) targeting clients systems from US, UK, Hong-Kong, Singapore and Russia.

We selected the most common findings for still unsecured tech and complemented them with quotas - aiming to enable you with arguments in discussions with your DevOps \ Dev teams.

Despite 6 years of progress, Kubernetes is still incredibly complex. What we've seen in the past year or so is a lot of enterprises are embracing Kubernetes, but then they run headlong into the difficulty.

Drew Bradstock

Google, Product Lead for Google Kubernetes Engine (GKE)

Common Kubernetes & OpenShift weaknesses

1

Secrets stored in plain text
Storing secrets in ConfigMap is remarkably the worst DevSecOps practice we ever met. Our advice here is to encrypt etcd and start implementing secrets management.
2

No Resource and API quotas
Kubernetes, OpenShift, Nomad, VmWare Tanzu - all can scale to billions of containers making a separate challenge for the cybersecurity team - controlling the scaling.
3

All container orchestration users had admin privileges
Early adopters of container orchestration technology often don't pay attention to security basics - like segregating user and admin privileges.

You know, when we first started to look at the cloud, more than 10 years ago, the general view was cloud is dangerous from a security perspective. There were so many things that you had to deal with: not having access directly, relying on a third party, perhaps, and it was a mess. The world has changed. In many cases, the cloud is much, much, more secure than the on-premise environment.

Dr. Larry Ponemon

Founder and Chairman of the Ponemon Institute

Common Amazon Web Services weaknesses

1

Open S3 buckets
Open S3 buckets are still proliferating AWS accounts. Our advice there is to check if a bucket is public manually or use all kinds of available S3 inspectors.
2

Leaked AWS access keys
AWS keys are often committed to ublic repos like GitHub or GitLab. Our advice there is to always keep On AWSCompromisedKeyQuarantine policy.
3

Switched off CloudTrail
The absence of logging means no possibility to get know what happened in your AWS, Azure, Google Cloud or AliCloud - identify scope of compromise and act.

Cyberlands.io Team