The National Science Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) have developed guidance for hardening Kubernetes as part of ongoing efforts to secure the software supply chain and to help organizations handle Kubernetes-associated risks.
According to the technical report, common sources of compromise in Kubernetes include:
- Supply chain risks
- Malicious threat actors
- Insider threats
“Supply chain risks are often challenging to mitigate and can arise in the container build cycle or infrastructure acquisition,” the report states. “Malicious threat actors can exploit vulnerabilities and misconfigurations in components of the Kubernetes architecture, such as the control plane, worker nodes, or containerized applications. Insider threats can be administrators, users, or cloud service providers. Insiders with special access to an organization’s Kubernetes infrastructure may be able to abuse these privileges.”
The report notes that Kubernetes supply chain compromises can occur at multiple levels including:
- Container/application level
- Container runtime level
- Infrastructure level
The guide includes strategies for system administrators and developers to help them avoid common issues and implement hardening measures. Recommended mitigations include:
- Scan containers and pods for vulnerabilities or misconfigurations.
- Use network separation to control the amount of damage a compromise can cause.
- Use firewalls to limit unneeded network connectivity and use encryption to protect confidentiality.
- Use strong authentication and authorization to limit user and administrator access as well as to limit the attack surface.
Refer to the complete report for comprehensive guidance.
Comments