Keynote: Learn by Hacking: How to Run a 2,500 Node Kubernetes CTF

The presentation discusses the experience of running Kubernetes CTFs to teach security principles and increase cloud native security expertise.

• The CTFs are designed to be approachable for all skill levels and progress in difficulty throughout the journey.
• The goal is to find the right rising tide that will lift all boats and that players have fast feedback and support to enhance their learning experience.
• The scenarios are intentionally increasingly complex and difficult to crystallize players' understanding of a wide and complex security landscape.
• The CTFs are played with a terminal IP address, an optional authentication credential for an SSH session, a Kubernetes cluster, or other mystery piece of infrastructure.
• The presentation also discusses how to build a tumultuous and exciting CTF challenge, why hands-on practice is the best way to ingrain security concepts, when automating a chaotic cluster pipeline doesn't scale, why points don't always win prizes, and how sharing knowledge helps us grow together.

The presentation includes a digital reconstruction by the street artist Banksy of what a bunch of pirates would look like playing a cloud native CTF with a splash of stable diffusion for effect.

TAG Security has run a CTF at Cloud Native Security events since 2020, but with a twist: instead of dastardly black hat hackers duelling for the title of Ultimate Kuberninja, we’ve focused on helping everybody to hack, teaching approachable security principles to increase the industry’s level of cloud native security expertise in novel and engaging ways.   In this talk, Andrés and Andy detail their learnings, techniques, and often last-minute fixes needed to run Kubernetes CTFs with thousands of nodes, hundreds of cloud native hackers, and buckets of coffee.  During these distributed orchestration challenges the events have seen servers burned, scenarios shredded, and authentication bypassed in all sorts of nefarious ways by the willing and able players of the game.   In this talk we detail our experience and discuss:  - How to build a tumultuous and exciting CTF challenge - Why hands-on practice is the best way to ingrain security concepts - When automating a chaotic cluster pipeline doesn't scale - Why points don’t always win prizes - And how sharing knowledge helps us grow together