NSA and CISA Kubernetes Security Guidance – A Critical Review • Hacker News Board

NSA and CISA Kubernetes Security Guidance – A Critical Review

#1

Post by kiyanwang » Sun, Sep 12, 2021, 10:24 AM UTC

NSA and CISA Kubernetes Security Guidance – A Critical Review
research.nccgroup.com

Re: NSA and CISA Kubernetes Security Guidance – A Critical Review

#2

Post by chmod-777 » Sun, Sep 12, 2021, 3:02 PM UTC

Thanks for sharing, we created an open source that takes any cluster and checks it against these guidelines, check it out, hope you find it useful: https://github.com/armosec/kubescape

Re: NSA and CISA Kubernetes Security Guidance – A Critical Review

#3

Post by dgdfg » Sun, Sep 12, 2021, 3:03 PM UTC

Re: NSA and CISA Kubernetes Security Guidance – A Critical Review

#4

Post by pklee » Sun, Sep 12, 2021, 7:02 PM UTC

chmod-777 wrote: post #2

Thanks for sharing, we created an open source that takes any cluster and checks it against these guidelines, check it out, hope you find it useful: https://github.com/armosec/kubescape

This looks great. Thanks for sharing. I hope at some point this becomes a gate for RMF process.

Re: NSA and CISA Kubernetes Security Guidance – A Critical Review

#5

Post by Ms-J » Sun, Sep 12, 2021, 10:06 PM UTC

So, you would like use to Curl | Bash a TLA security guidance script, really?

No package and hash database?

It's trivial to detect when a script is being downloaded to disk or piped to a shell, btw.

I saw this same group post another thread about this recently.

Re: NSA and CISA Kubernetes Security Guidance – A Critical Review

#6

Post by chmod-777 » Mon, Sep 13, 2021, 7:45 AM UTC

Ms-J wrote: post #5

So, you would like use to Curl | Bash a TLA security guidance script, really? No package and hash database? It's trivial to detect when a script is being downloaded to disk or piped to a shell, btw. I saw this same group post another thread about this recently.

Hi, you do not have to use the curl | bash options, completely understand the concern (I am also like that), but we wanted to make it easy for those who like it easy :-)

It is completely open source, you can take the executables and run it yourself, compile it, change it, however you feel like :-)

If you do try it, let us know how it is, happy to get feedback!