SEC584 will perform a deep dive into defending key infrastructure deployment components, focusing on containerization and orchestration exploits. Students will be thrust directly into detailed issues related to misconfiguration and known attack patterns and will learn how to properly harden and protect against these exploits.
Deploy Securely At The Speed Of Cloud Native
Cloud native infrastructure and service providers are enabling organizations to build and deliver modern systems faster than ever. The end-to-end toolchain supporting the systems includes managed services to create cloud infrastructure, store source code, build containers, and manage clusters. For information security professionals, the attack surface created by these modern systems can be difficult to defend and monitor. SEC584 explores Docker and Kubernetes, key components of the cloud native infrastructure stack, providing in-depth analysis of the attack surface, misconfigurations, attack patterns, and hardening steps. Students will gain hands-on experience building, exploring, and securing real-world modern systems through an offensive lens.
SEC584 starts by painting a portrait of the modern cloud-native infrastructure hosted in Google Cloud. After deploying cloud resources, students examine methods of compromise, walk through attack scenarios, and then shift their focus to defending and remediating infrastructure services. This includes hardening Kubernetes orchestrator and workload configuration, deploying security testing and monitoring software in pipelines and clusters, cryptographically signing images and build pipelines, and applying AppArmor and Seccomp profiles to containerized workloads.
The course then shifts its focus to defending a live Kubernetes deployment. After students identify several Kubernetes weaknesses, hands-on exercises attacking and remediating security and network policies and admission controllers will help them lock down the lab environment. Attacks and controls are threat-modeled to ensure they are applied correctly, tested out-of-band to ensure their efficacy, and applied at multiple stages throughout the pipeline to enhance engineers' productivity and feedback loops.
THIS COURSE WILL PREPARE YOU TO:
YOU WILL BE ABLE TO:
WHAT YOU WILL RECEIVE:
Section 1 covers the cloud native security model, threat model, and associated infrastructure security practices. This includes deploying and rooting Jenkins to gain remote code execution on a Google Cloud virtual machine to illustrate security considerations of container workloads, introducing and deploying our first Kubernetes cluster, and starting to learn how to defend it by attacking.
Cloud Account Setup
Deploy and Root Jenkins
Kubernetes 101
Attacking Kubernetes
What is Cloud Native Security
Modern Infrastructure Security Practices
Kubernetes 101
Attacking Kubernetes
Section 2 covers concepts related to the containerization of applications, including the risks and benefits of deploying applications in containers. We look at Docker containers, examining how they are created, maintained, and deployed. Then we review the risks associated with deploying applications in Docker containers, and explore ways that Docker containers and CI/CD can be hardened and secured.
Container Security
Container Image Security
Hardening Kubernetes
Securing the CI Pipeline
Container Security
Container Image Security
Hardening Kubernetes
Securing the CI Pipeline
Section 3 focuses further on attacking containerized applications, and protecting them with Kubernetes-native solutions. We look at the potential risks and vulnerabilities associated with Kubernetes workloads, as well as how we can secure them through automated scans, proper policy definitions, and continuous intrusion detection.
Defending Containerized Workloads
Policy and Controls
Container Security Testing
Attacking Image Delivery and Registries
Attacking Containerized Workloads
Policy and Controls
Container Security Testing
Attacking Image Delivery and Registries
SEC584 performs a deep dive into defending containerized workloads (Docker) and orchestrators (Kubernetes). Courses or equivalent experiences should include:
For those looking to prepare ahead of time, check out the following resources:
Docker QuickStart: https://docs.docker.com/get-started/
Kubernetes Basics: https://kubernetes.io/docs/tutorials/kubernetes-basics/
Terraform Getting Started Guide: https://learn.hashicorp.com/terraform/getting-started/install
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
Mandatory: Students must bring their own GCP account to complete the exercises. Please ensure that you have done the following before class starts:
Google Cloud Platform
BRING YOUR OWN LAPTOP CONFIGURED USING THE FOLLOWING DIRECTIONS:
A properly configured system is required for each student participating in this course. Before starting the course, carefully read and follow these instructions exactly:
Mandatory Host Hardware Requirements
Mandatory Host Operating System Requirements
You must use a 64-bit laptop with one of the following operating systems that have been verified to be compatible with course VMware image:
Mandatory Software Requirements
Prior to class, ensure that the following software is installed on the host operating system:
In summary, before beginning the course you should:
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.
"The proliferation of containers and the growth of Kubernetes and its supporting ecosystem offer a new opportunity for organizations looking to adopt modern development, deployment, and security practices. Containers share their host's kernel and so are more efficient and lightweight than VMs, but they provide a different set of security guarantees. And as cloud providers have built out their managed offerings, the shared responsibility model puts the ultimate responsibility for the security of users' infrastructure on their shoulders.
Highly scalable and resilient distributed systems bring additional complexity, and DevSecOps security can only be achieved with a solid DevOps engineering foundation on which to build. Once this is established, automated security verification can prove the absence of known regressions and reduce the likelihood of unknown vulnerabilities.
Attackers have exploited misconfigured Docker and Kubernetes instances, container and application supply chains, and the cloud infrastructure with which they integrate. This course examines all of these attacks in detail, shows attendees how to undertaken them, and provides detailed remediation and testing steps to ensure cloud native infrastructure is locked down, while still providing value to the business."
"Very knowledgeable, especially appreciate the extra anecdotes and background as that was especially useful in my learning experience today." - Jacob Austin
