Following the news that:
93% of Kubernetes users struggle with security
Following the news that:
93% of Kubernetes users struggle with security
2020 Cybersecurity Landscape: 100+ Experts’ Predictions
Cyber Security Predictions 2021: Experts’ Responses
Experts’ Responses: Cyber Security Predictions 2023
Celebrating Data Privacy Day – 28th January 2023
Data Privacy Protection Day (Thursday 28th) – Experts Comments
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
This report from Red Hat highlights some really important security considerations. Because cloud-native design relies on new technology stacks such as containers, Kubernetes and service mesh, it also requires API development, integration, and consumption. This, in turn, creates a larger attack surface. In addition to threats caused by cloud complexity itself, the cloud also increases exposure of some assets beyond more well-understood, on-premises data centre environments.
Access controls are difficult to get “right” when organisations must support multiple environments and consumer types. There have also been cases of server-side request forgery. A good example is the Capital One incident where attackers use web applications or web APIs as the front door into back-end cloud provider metadata services and infrastructure. Kubernetes (and its APIs) are usually an internal service used by the service provider/maintainer and not by its users. This in turn can play to the hands of attackers, as exposing these APIs may turn a very small attack surface to a very big one – allowing the attackers to try and find number of issues that could be abused in the API service itself, whether from misconfigurations of the service itself, or from well-known API class vulnerabilities.