Skip to main content

How has the security of Kubernetes evolved in recent years?

(Image credit: Shutterstock / Song_about_summer)

How has the security of Kubernetes evolved in recent years?

There has been unprecedented growth in the adoption of Kubernetes, with almost 70 percent of organizations increasing their usage as a direct result of the pandemic. This is causing enterprise security to be challenged like never before, creating both increased complexity and blind spots.

Security teams don’t have visibility of every single Kubernetes project, making it virtually impossible to secure them all at the speed that developers are working at.

It’s not just the increasing popularity of Kubernetes that’s causing a problem. The dynamic nature of cloud-native architecture is also an issue. In fact, 61 percent of organizations say their cloud environments are changing every minute or less, and nearly a third say they change at least once per second. All this change is driving an exponential rise in the number of new machines and corresponding machine identities – be they microservices, containers or virtual machines. Machine identities are the certificates and keys that systems use to communicate with each other in an encrypted fashion, keeping data safe and secure.

Although most of these applications will be spun up and down in a matter of seconds, they still require an identity, which must be managed throughout its entire lifecycle. This is where it becomes tricky. Enterprises are now struggling to issue and manage all of these identities at the speed and scale needed for the successful operation of cloud services. This is creating yet more security (opens in new tab) risks and application outages due to the mismanagement of machine identities. This also means there are many orphaned machine identities left on networks, which all pose an inherent security risk.

Are there more attacks than before, or are we just seeing more specifically targeting Kubernetes?

With more organizations using Kubernetes than ever before, it’s causing hackers to see it in a new light. So, it’s not just that we’re seeing more attacks than before, it’s that cybercriminals are spotting new opportunities to profit. Already in the last few months, we’ve seen cybercrime gang Team TNT taking advantage of misconfigured Kubernetes clusters. After gaining initial access, their malware, dubbed Hildegard, was able to access high numbers of containers by making use of insecure SSH keys and other machine identities before deploying a cryptominer.

Another attack saw malicious Azure users able to take over other customers’ cloud instances within Microsoft’s container-as-a-service offering. This ‘Azurescape’ infiltration is another example of how attackers can use Kubernetes to steal sensitive data, enable crypto mining or execute harmful code. While cloud developers have a wealth of Kubernetes knowledge, it’s physically impossible for them to be able to implement robust security controls for every single cloud instance. Hackers are aware of this and make good use of it by evolving their techniques and attack methods. It’s this that’s seen the likes of Capital One and Docker experiencing high-profile breaches.

As Kubernetes gains more popularity we expect to see the number of attacks grow. That’s unless organizations start to take a more active role in the protection of their Kubernetes environments.

What are the common mistakes enterprises are making within their Kubernetes deployments?

The ease of use and simple processes required to deploy Kubernetes is one of its many advantages. However, this also causes one of the most common mistakes made by organizations. Many heavily rely on the default settings of Kubernetes, which helps to quickly deploy new applications, even though these settings aren’t inherently secure. For instance, network policies mean all applications can communicate with each other with no restrictions. Meanwhile applications can also use any container image, a type of static file with executable code, regardless of whether it has come from untrusted sources. This overreliance is opening enterprises up to a whole host of vulnerabilities that cybercriminals are increasingly making use of.

Another common mistake organizations are making when it comes to Kubernetes is the misconfiguration and mismanagement of machine identities. This is a scary prospect, given that these identities expire after a short length of time and are crucial for protecting data in transit between applications. If these become misconfigured or forgotten about, then it’s possible for hackers to steal or forge those identities and use them to conduct attacks. Not only could this cause critical workloads to fail, but sensitive information could be lost, and even greater control can be given to an attacker seeking to take over an entire network.

This is worrying when you think an explosion in machine identities coupled with the dynamic nature of the cloud means manual management is simply not possible. At the same time, the constant development of new identities means security holes are constantly opening up as developers create more and more applications without using quality control to check them against security standards.

In addition, businesses are failing to take accountability for their own security. They need to better follow security best practice and embrace a DevSecOps culture where security is made a priority right from the outset. It’s a failure to do this that’s causing organizations to get into trouble. With growing demand for digital services, developers are constantly focused on just building and innovating to speed up the time to market. Instead, they need to better align with security teams on their Kubernetes deployments to ensure they remain protected and monitored for any issues that may crop up.

What steps can organizations proactively take to keep their Kubernetes infrastructure safe from attackers?

Research from Canonical shows more than one in two organizations are challenged by a lack of in-house Kubernetes skills. One action organizations can take to address this growing skills gap is engaging with experts to educate and upskill employees on how to handle Kubernetes infrastructure. At the same time, businesses need to accelerate their cloud maturity to ensure they are aware of all the risks and threat mitigation tactics. While development teams are enthused about the tools at their disposal and are busy creating cloud-native applications at pace, security teams are still struggling to keep up.

However, increasing cloud maturity is no easy task. Cloud-native technologies are new, and most companies have limited knowledge and experience with them. That’s why it’s imperative that organizations work with partners who can provide the necessary skills, processes, and tools to enable fast, secure cloud-native development.

Organizations must also embrace automation technologies. This includes automating the issuing, configuration, and management of machine identities, so developers can deploy new applications without having to worry about the security or integrity of the infrastructure they deploy to.

Automation will ensure pressure is taken away from overstretched staff members. Instead, they can focus their time and effort on driving value to the business. This will ensure real-time visibility, adherence to security standards, and the ability to react to security risks in real-time.

What role does zero trust play in the ongoing protection of Kubernetes?

Zero-trust is going to have an increasingly important role to play in the ongoing security of Kubernetes. With so many instances and enterprise workloads growing, it’s going to be impossible to manage all those machine identities and be able to verify every single application and user within the system. This is particularly true when some containers will be spun up and down within seconds.

Therefore, a zero-trust approach should be implemented whereby it’s assumed every application needs to be verified and authenticated all the time.

For this to work within cloud native (opens in new tab) environments, trust must be enforced at the workload level with machine identities having a fundamental role. Automation will be key for managing these identities with a zero-trust approach at a rate that will keep up with modern development and the scale needed for mass enterprise applications.

Richard Collins, Head of Product, Jetstack (opens in new tab)