The Hitchhiker's Guide to Kubernetes Vulnerabilities

The presentation discusses the importance of staying up-to-date with Kubernetes vulnerabilities and the need to consider environmental scoring when assessing their severity.

• Canonical sources for vulnerability information may not always be up-to-date
• Staying on an up-to-date version of Kubernetes is crucial for security
• Environmental scoring can change the severity of a vulnerability based on how it's deployed
• Rescoring vulnerabilities is important to understand which ones to escalate
• The number of unique CVEs has consistently decreased over the last few years

The speaker gives an example of a vulnerability that was initially scored as a 'game over' vulnerability, but after environmental scoring was taken into account, it was downgraded to a less severe rating. This highlights the importance of understanding how vulnerabilities are deployed in an organization and the need to consider environmental scoring when assessing their severity.

The earth is gone. You’re the only one left. Was Kubernetes to blame? Is prior performance a strong indicator of future behavior? Is Kubernetes on a positive security trajectory? Have community efforts improved security? The speakers will present research that examines security problems throughout the entire history of the Kubernetes project. They explore patterns and trends in the data. They show a taxonomy for classifying k8s vulnerabilities; including analysis of root causes and contributing factors. They dive into each issue, examining metrics like time from commit-to-discovery, time-to-resolution, detection of similar events etc. They look to patterns of previous behavior to help the audience predict future performance. They interview leaders in the community and overlay historical security data with efforts to improve security. They show the impact SIGs, WGs, Audits, etc had on k8s security and suggest how the security posture of k8s might evolve in the future.