Written By: Robert Brennan
It’s not an exaggeration to state that cloud native technology is revolutionizing how organizations are developing and delivering applications. As organizations increasingly adopt microservices and containers, many are turning to Kubernetes for container orchestration. Kubernetes controls both resource allocation and traffic management for cloud applications and microservices, providing critical capabilities for running applications in a 24x7 world. K8s enables auto-scaling, auto-recovery, and more. While the benefits of Kubernetes are impressive, many organizations struggle with five common Kubernetes security mistakes. Does your organization?
Kubernetes Challenges for Organizations
Kubernetes is complex, and requires considerable learning and practice before teams gain confidence in their Kubernetes environment. If you’re just starting out, you may lack the tools, processes, and experience necessary to successfully launch Kubernetes environments. Not only that, there’s a considerable culture change that must occur in development, operations, and security teams, because Kubernetes and containers present a new approach for deploying applications. These changes mean that operations and security teams question whether the applications and data will be secure when the organization adopts microservices, containers, and Kubernetes to develop and deploy applications.
Security in a Cloud Native World
In the cloud native model, many of the traditional security tools and processes are no longer the right choice, while at the same time, containers create new blind spots and attack surfaces. Getting the visibility you need across containers and clusters poses an additional challenge. In the new paradigm, developers may find that it’s now necessary to take responsibility for some of the new security challenges, which is a role most devs are unaccustomed to and may be reluctant to embrace.
So what are the most common Kubernetes security mistakes that most organizations make?
Granting access to the host node — it’s easy to give admin level access to applications, but it can increase your risk of attack.
Assuming the operations team is aligned with security — Kubernetes offers many configuration options, which offer a lot of flexibility — and complexity — that security teams need to understand.
Running containers with known vulnerabilities — Kubernetes uses containers to deliver applications, but many teams aren’t aware of the known vulnerabilities that might be exposed in those containers.
Expecting security by default using native controls — while Kubernetes does offer native security features, many are not enabled by default.
Moving to production before you are ready — many teams, in their understandable excitement to get applications up and running in Kubernetes, rush to push apps live, leading to security gaps.
These five mistakes can be avoided by continuously scanning your clusters in dev and production environments. Identifying them is half the battle. Learn how you can identify mistakes and remediate them. To get started on improving your Kubernetes security, learn more about the top five mistakes you’re probably making — and get the information you need to fix them. Read the white paper.
Written By: Robert Brennan
Top comments (0)