How to Improve Your Kubernetes Security Posture

Originally published by Sysdig.

Written by Alba Ferri, Sysdig.

KSPM or Kubernetes Security Posture Management refers to the security state and capabilities in place to manage the defense of the Kubernetes clusters and the workloads running on top of it. It also includes how well it can predict, prevent, and respond to cyber threats that are constantly changing in relation to Kubernetes.

If that definition sounds familiar, that’s because it is the common definition of what Security Posture is, but focused on Kubernetes security.

CSPM and Kubernetes Security Posture

The parent use case is known as Cloud Security Posture Management, or CSPM, which evaluates and prioritizes policy violations for cloud resources. So, as you can guess, Kubernetes Security Posture Management (KSPM) is just one of the sub-cases of CSPM.

The KSPM score is one of the pieces of evidence that security teams use as a finding when beginning the information gathering process to pass a security audit.

For a cloud security engineer, the Kubernetes Security Posture score can just be a percentage number. The higher the percentage number, the better the Infra/Ops team is doing at following security best practices for the Kubernetes environment. The lower the number, it means the fateful number is going to chase us until we fix all those configuration issues that do not meet the security guidelines.

Security audits vs. Security Posture

Security audits have become common procedures in today's companies. They help organizations to protect sensitive data, identify security risks, and ensure employees stick to security practices. Regular audits force us to continuously re-evaluate our security policies or create new ones to keep up with the latest threats and track the effectiveness of our security strategies.

On the other hand, the Security Posture of the different pieces that make up our IT environment help us to get an idea of how close we are to pass a security audit.

There are several organizations that provide Kubernetes security guidance, but CIS is probably the most used one among security teams. The independent, nonprofit organization provides Controls and Benchmarks as configuration baselines and best practices for securely configuring systems. There are CIS benchmarks for all kinds of environments: Linux hosts, cloud providers, Webservers, Databases…and Kubernetes has its own CIS benchmarking as well.

The new mission: improve Kubernetes Security Posture

If you are using Kubernetes to orchestrate your workloads, in the cloud or on-prem, managed or self-controlled, there is a good chance that you’ve heard that fearsome sentence: We need to improve our Kubernetes Security Posture.

For the Ops/Infra teams that are already overwhelmed in their daily duties, all the extra work to fix Kubernetes' bad practices can be a big headache.

When security comes as an urgent task to apply, we end up working in a reactive way. Whatever was planned now will need to be rearranged for later. That training you were supposed to be giving is going to be delayed, too. And the on-prem platform you were going to migrate to a managed service in the cloud will have to wait a little longer.

Asking the right questions (and answering them)

Depending on the tools and processes you have put in place to provide Kubernetes Security Posture insights, you will be more or less successful when trying to improve the Kubernetes Security Posture score.

Some of the questions you should be asking to check if you have the proper tooling or processes are:

• Do I have enough visibility?
• Can I prioritize what violations to fix first?
• Can I remediate at the source?

Policy Enabled Kubernetes using Policy-as-Code

The Open Policy Agent, or OPA, is a policy engine that evaluates policies and data to produce query results. OPA can be used under the hood to check security and compliance policies against cloud-native infrastructure, like Linux instances, containers, and Kubernetes environments. But what’s more interesting is that this can also provide a workflow for remediation at the source.

Step 1: Visibility - Set the basis

This might seem obvious, but to know where to start, the teams involved in the Kubernetes management process need to be aware of the actual state of the Security Posture of your Kubernetes clusters.

Having visibility is going to be crucial to do a good job.

Kubernetes Security Posture is the result of the cycles of the posture management process, and to obtain Kubernetes Security Posture metrics you need a KSPM process.

Before you start, share the KSPM results among the team to start tracking progress.

Step 2: Prioritize - Define your working strategy

Not all bad practices are rated the same. Some pose more risks than others.

It is not the same to have Over permissive access to a resource type than having ServiceAccounts with the Ability to create pods in a cluster (which can ultimately open up possibilities for privilege escalation).

Being able to filter and prioritize is key when designing your strategy to improve the KSPM score. To optimize your time as much as possible, start remediating the highest risks first.

This can be the foundation to start your Kubernetes Security Posture improvement strategy, and how you would tackle it.

Controls are either failed or passed. There is no magic to it.

But the reason behind why this happens can be slightly different.

Knowing the real reason why a control failed may seem of no interest (let’s fix it and keep on), but the reality is that if you pay attention to these nuances, you can unveil gaps in how your team works. For example, like not having enough time to plan a deployment ahead, insufficient knowledge of security risks of the underlying technology, or lack of resource optimization. Being able to see all these details means you can address them.

Step 3: Remediate at the source

When having to remediate failed controls from security policies, teams that use automation, prefer to keep using this methodology, integrating the remediation workflow with their tools.

You can tie Kubernetes security violations with the Infrastructure-as-Code (IaC) manifest that defines your Kubernetes resources, in your git repository, identifying the two ends of the pipeline.

Using this approach will narrow your attack surface at runtime, but also, you can be sure those changes are reflected in your IaC manifest and won’t happen again.

Conclusion

Kubernetes requires thoughtful design to ensure that governance, compliance, and security controls are included. You can use automation to remediate and maintain a well-managed and secure cloud while increasing your Kubernetes Security Posture score.

With a tool that provides KSPM and actionable compliance, including automated remediation at the source code manifest, fixing security violations of the Kubernetes environment should not be something that is done all at once, in a rush, when an audit approaches. Rather, it should be a continuous improvement process that aims to obtain a basically compliant/secure infrastructure that only requires minor adjustments every now and then.