1 of 33

Minimalism:

Key to Cloud Security

Back

Next

2 of 33

$ whoami

Back

Next

Barun Acharya (@daemon1024)

​

  • Software Engineer @ Accuknox
  • Maintainer @ KubeArmor (CNCF Sandbox)
  • CNCF Ambassador
  • Google Summer of Code
  • LFX Mentorship
  • Open Source Developers Community
  • Undergraduate Student Graduated wohooo!!

3 of 33

Container

Back

Next

4 of 33

Container

Security

Back

Next

5 of 33

Back

Next

6 of 33

Malicious Actors

Back

Next

7 of 33

Minimalism

Back

Next

8 of 33

Minimal Node Images

Back

Next

  • Container Optimized OS by Google Cloud
  • BottleRocket by AWS
  • RancherOS
  • …..

9 of 33

Minimal Node Images

Back

Next

  • Immutable Root File System

10 of 33

Minimal Node Images

Back

Next

  • Immutable Root File System
  • Reduced System Bloat

11 of 33

Minimal Node Images

Back

Next

  • Immutable Root File System
  • Reduced System Bloat
  • Hardened Kernel

12 of 33

Minimal Node Images

Back

Next

  • Immutable Root File System
  • Reduced System Bloat
  • Hardened Kernel
    • Integrity Measurement Architecture (IMA)

13 of 33

Minimal Node Images

Back

Next

  • Immutable Root File System
  • Reduced System Bloat
  • Hardened Kernel
    • Integrity Measurement Architecture (IMA)
    • Secure Boot

14 of 33

Rocke Malware

Back

Next

  • Self-Replication:
    • The malware copies itself from "/tmp/kthrotlds" to "/usr/sbin/kthrotlds."
    • It alters the modified time stamp of the copied file, setting it back 416 days.
  • Shared Object Injection:
    • The malware writes code to "/usr/local/lib/libcset.c" and compiles it using GCC into a shared object at "/usr/local/lib/libcset.so."
    • If GCC is not installed, the malware attempts to install it and recompile.
  • Startup Scripts:
    • The malware installs an "init.d" startup script at "/etc/init.d/netdns" and a systemd service script at "/usr/lib/systemd/system/netdns.service."
    • It changes the modified time of these files in a similar manner.�

https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang

15 of 33

Rocke Malware

Back

Next

  • Self-Replication:
    • The malware copies itself from "/tmp/kthrotlds" to "/usr/sbin/kthrotlds."
    • It alters the modified time stamp of the copied file, setting it back 416 days.�Immutable Root File System
  • Shared Object Injection:
    • The malware writes code to "/usr/local/lib/libcset.c" and compiles it using GCC into a shared object at "/usr/local/lib/libcset.so."
    • If GCC is not installed, the malware attempts to install it and recompile.�No system packages/package managers and File Integrity
  • Startup Scripts:
    • The malware installs an "init.d" startup script at "/etc/init.d/netdns" and a systemd service script at "/usr/lib/systemd/system/netdns.service."
    • It changes the modified time of these files in a similar manner.�Secure Boot�

16 of 33

Containers

Back

Next

17 of 33

Containers

Back

Next

18 of 33

Containers

Back

Next

19 of 33

Lightweight Images

Back

Next

20 of 33

Lightweight Images

​

Back

Next

21 of 33

Containers

Back

Next

  • Kubernetes Security Context
    • LSM Profiles/Labels
    • Seccomp
    • Capabilities
  • Docker Security Opts
    • Other Container Runtimes Support this as well
  • Proxy Filters/Service Mesh/Container Networking Interface Rules
  • Docker Slim to trim down unnecessary filesystem
  • Like Node Images use lighted base images for container like alpine, wolfi

22 of 33

Role Based Access Control

Back

Next

23 of 33

Uber Social Engineering Attack

Back

Next

  • Perimeter Security around Sensitive Files using VPN
  • VPN Access protected through Multi Factor Authentication

24 of 33

Uber Social Engineering Attack

Back

Next

  • MFA breached through Social Engineering
  • Attacker Scans Intranet for Sensitive Assets
    • Finds Shell Script with Admin Password to PAM
    • Finds secrets to all services through PAM

25 of 33

Back to Containers

Back

Next

What if

we are already compromised?

​

26 of 33

Back to Containers

Back

Next

What if

we are already compromised

​

27 of 33

Access Control Inside Containers

Back

Next

28 of 33

Access Control Inside Containers

Back

Next

  • Setup Observability to gain visibility
  • Linux Security Modules
  • Userspace Interception
    • LD_PRELOAD
    • Ptrace

29 of 33

Access Control Inside Containers

Back

Next

  • Setup Observability to gain visibility
    • Falco
    • Tracee
  • Linux Security Modules
    • AppArmor Rules (supported by k8s security context and docker security opts)
  • KubeArmor

30 of 33

Conclusion

Back

Next

Minimalism : Key to Cloud Security

31 of 33

Conclusion

Back

Next

Minimalism : Key to Cloud Security

​

  • Need for Multi Layered Minimalistic Approach
  • Minimal Node Images / Runtime Infrastructure
  • Setup Perimeter Around Containers to minimize outside access
  • Minimize Attack Surface Outside and Inside Containers by removing unnecessary dependencies
  • Setup Perimeter Inside Containers to minimize unnecessary accesses
  • Minimum Permissions to all users to prevent social engineering attacks

32 of 33

ThankYou

Back

Next

33 of 33

ThankYou

​

Questions (⁠づ⁠｡⁠◕⁠‿⁠‿⁠◕⁠｡⁠)⁠づ

Back

Next