Risky Business #725 -- Microsoft knifes VBScript, passkeys the new default for Google accounts
Oct 10, 2023
auto_awesome
Guest Jimmy Mesta from KSOC discusses applying IAM to Kubernetes environments. Topics include Microsoft ditching VBScript, Google's switch to passkeys, MGM's cyberattack losses, Clorox's struggles, and the potential dangers of a cURL bug. The episode also touches on cybercrime trends, state-backed attacks, ransomware, and the spread of disinformation.
Microsoft discontinuing VBScript enhances system security measures.
Google switching to passkeys as default improves user authentication security.
Various security breaches emphasize the importance of robust cyber defense strategies.
Deep dives
Challenges in IAM for Kubernetes and Cloud Environments
In both Kubernetes and cloud environments, IAM presents challenges with granular access control and lack of observability. While cloud IAM is complex with attributes and granularities, Kubernetes RBAC poses equal challenges with objects, verbs, and knobs to manage. Establishing observability and manipulation of RBAC through Kubernetes plumbing is crucial for wrangling access control.
Identity Provisioning Issues in Kubernetes Environments
Identity provisioning in Kubernetes environments often involves generic group-based access granting, leading to broad permissions within clusters. The lack of scoping down to specific applications or services results in potential security vulnerabilities. Access typically tied to identity providers and managed through static Kubeconfig files can lead to exposures if stolen or misconfigured.
Logging and Monitoring Role Activities in Kubernetes
Enhanced logging and monitoring of role activities in Kubernetes is essential for auditing and detecting anomalies. Building a profile of user actions, verifying role permissions, and tracking excessive access can aid in role security management. Leveraging Kubernetes logs for improved visibility and compliance is a recommended best practice.
Addressing Service Accounts and Authentication Challenges in Kubernetes
Service accounts present additional complexities in Kubernetes, requiring specialized handling and monitoring for programmatic access. The unique challenges posed by service account authentication and authorization highlight the need for enhanced security measures specific to service accounts. Strategies for securing service accounts and addressing the risks associated with their access should be prioritized.
Future Developments in IAM for Kubernetes and Cloud Environments
The future of IAM in Kubernetes and cloud environments involves evolving towards more granular, just-in-time, and application-specific access controls. By integrating observability, telemetry, and auditability features, organizations can achieve more secure and compliant IAM practices. Addressing identity provisioning challenges, enhancing logging, and monitoring role activities are key focus areas for improving IAM in Kubernetes and cloud environments.
On this week’s show Patrick Gray and Lina Lau discuss the week’s security news. They cover:
Microsoft has killed VBScript
Google to make passkeys the new default sign-in method
MGM losses to exceed $100m
Clorox has a bad quarter
Why a bug in cURL could be really bad news
Much, much more
This week’s show is brought to you by KSOC. Jimmy Mesta, KSOC’s co-founder and CTO, is this week’s sponsor guest. He talks to us about how we can start applying real, actual IAM to Kubernetes environments.