Course · Training · Workshop
Marco de Benedictis: Advanced Kubernetes Security: Learn By Hacking
Architecture, security, and delivery of Kubernetes systems using the best current and next-generation tooling – written by "Hacking Kubernetes" author and SANS instructor Andrew Martin.
Combining Red Team (offensive) and Blue Team (defensive) approaches, information security professionals and engineers will gain an understanding of the attack surface of a cloud native system: from building applications into containers and appraising supply chain vulnerabilities, through runtime detection and monitoring, to evading the system’s defences and popping shells, this course gives you the tools you need to understand how to attack and defend against present and future threat actors. Attendees will gain hands-on experience building, exploring, and securing real-world systems through an offensive lens.
Trainers
What participants say
These customers booked courses in the same topic cluster.More customers →
Content
Attendees have access to cloud-hosted clusters and will examine methods of compromise, play attack scenarios against real infrastructure, and then shift their focus to defending and remediating infrastructure services. This includes hardening the Kubernetes orchestrator and workload configuration, deploying security testing and monitoring software in pipelines and clusters, attacking and defending container supply chains, cryptographically signing images and build pipelines, exploring intrusion detection and monitoring, applying AppArmor and Seccomp profiles to defeat attacks, and understanding next-generation runtimes. The course leverages threat modelling to apply realistic attack vectors and define test driven security controls. These are applied at multiple stages throughout the pipeline to enhance engineers’ productivity and feedback loops.
- Wargame custom scenarios against real clusters on production infrastructure
- Use real-world exploits to target key application deployment components
- Explore vulnerabilities to cloud native deployments through authentication, pipeline, and supply chain exploits
- Understand the risks involved in running cloud native infrastructure
- Threat model and remediate threats with optimal defensive controls
- Exploit and then secure application deployments via Docker and Kubernetes
Course Outline
- Container exploitation by example
- Kubernetes attack surface
- Kubernetes deployment pipelines
- Source control signing and verification
- Container image vulnerability scanning
- Circumventing pipeline controls
- Image signing with Cosign and Notary
- Pipeline metadata collection and enforcement
- Supply-chain verification with in-toto and Tekton Chains
- Kubernetes & container security testing
- Secure GitOps deployments with Flux
- Users, identity, and RBAC
- Runtime security and intrusion detection
- Network policy and lockdown
- Service meshes and workload identity
- Advanced container isolation
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about Advanced Kubernetes Security
Kubernetes is the de facto platform for container orchestration in modern cloud infrastructures and at the same time presents a complex attack surface that requires both offensive and defensive security knowledge. From hardening the Kubernetes API server and supply chain security with image signing, to runtime detection with tools like Falco, the topic encompasses a broad spectrum of techniques and best practices. A deep understanding of these mechanisms is essential for any team operating Kubernetes in security-critical production environments.Further resources:
History
Kubernetes was released as an open-source project by Google in 2014, drawing on internal experience with the Borg cluster manager. Its adoption into the Cloud Native Computing Foundation (CNCF) in 2016 marked the beginning of its rapid rise to become the dominant container orchestration platform. In parallel, awareness of security risks grew: vulnerabilities such as CVE-2018-1002105 (privilege escalation in the API server) and high-profile attacks on poorly configured Kubernetes clusters raised the community's awareness of security concerns.
The introduction of tools like Falco (2018) for runtime security and Trivy (2019) for vulnerability scanning, along with the development of standards such as the CNCF Security Technical Advisory Group White Paper, have established Kubernetes security as an independent discipline. Today, leading organizations integrate security scanning, policy enforcement, and runtime monitoring as integral components of their Kubernetes pipelines.