Jesper Larsson, a Freelance PenTester, discusses the importance of security in Kubernetes and infrastructure as code. They cover topics such as access permissions, web application vulnerabilities, pen testing experiences, and common mistakes to avoid. Jesper also shares his background in hacking and penetration testing, emphasizing the significance of networking at meetups. The podcast explores vulnerabilities in third-party software companies and the limitations of using example code. They also discuss an AI tool for analyzing overprivileged accounts in Google Cloud.
Storing secrets in ConfigMaps is a common mistake and not a secure storage solution for sensitive information.
Understanding the differences between Kubernetes RBAC and IAM roles is crucial for secure access management in cloud environments.
Deep dives
Common Mistake 1: Using ConfigMaps for secrets
Jesper Larsen emphasizes the common mistake of using ConfigMaps to store secrets, even though it is explicitly mentioned in the documentation that it is not a secure storage solution for sensitive information.
Common Mistake 2: Misunderstanding IAM concepts
Jesper discusses the common misunderstanding of IAM concepts, specifically the confusion between Kubernetes role-based access controls (RBAC) and IAM roles in cloud environments. He highlights the importance of understanding the differences and implications of IAM roles and RBAC to ensure secure access management.
Know your product
Jesper advises listeners to have a deep understanding of their product, including knowing how it interacts with the network, what permissions are required, and any potential vulnerabilities or misconfigurations. By having a comprehensive understanding, teams can proactively address security issues and make informed decisions.
Jesper Larsson is a Freelance PenTester. Jesper works with a hacker community called Cure53. Co-organizes SecurityFest in Gothenburg, Sweden. Hosts Säkerhetspodcasten or The Security Podcast. Jesper is also a Star on Hackad, a Swedish TV Series about hacking.
Do you have something cool to share? Some questions? Let us know: