Uma análise das vulnerabilidades de segurança do Kubernetes
Resumo
Os orquestradores de contêineres vêm ganhando mais utilizadores a cada ano, sendo utilizado nas infraestrutura de pequenas e grandes empresas. Atualmente, o Kubernetes é o orquestrador mais utilizado e apresenta uma arquitetura de gerenciador e trabalhadores. O uso de diversos recursos normalmente aumenta a superfície de ataque, sendo assim, é possível explorar vulnerabilidades para atacar o cluster. Este artigo tem por objetivo fazer uma análise das principais vulnerabilidades do Kubernetes, relacionando as vulnerabilidades e os componentes de um sistema de orquestração.
Referências
Budigiri, G., Baumann, C., Muhlberg, J., Truyen, E., and Joosen, W. (2021). Network policies in kubernetes: Performance evaluation and security analysis. pages 407–412.
David, R. B. and Barr, A. (2021). Kubernetes autoscaling: Yoyo attack vulnerability and mitigation. In CLOSER.
Jensen, N. and Miers, C. C. (2020). Segurança de contêineres: taxonomia baseada na arquitetura. In Anais da XVIII Escola Regional de Redes de Computadores, pages 128–134, Porto Alegre, RS, Brasil. SBC.
Kronser, A. (2020). Common vulnerabilities and exposures : Analyzing the development of computer security threats. Master’s thesis, Helsingin yliopisto.
Kubernetes (2021). Kubernetes documentation. https://kubernetes.io/docs.
Marathe, N., Gandhi, A., and Shah, J. M. (2019). Docker swarm and kubernetes in cloud computing environment. In 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), pages 179–184.
Mercl, L. and Pavlik, J. (2018). The comparison of container orchestrators.
Minna, F., Blaise, A., Rebecchi, F., Chandrasekaran, B., and Massacci, F. (2021). Understanding the security implications of kubernetes networking. IEEE Security Privacy, pages 2–12.
MITRE (CVE Terminology) (2021). Cve terminology. https://cve.mitre.org/about/terminology.html.
Nyanchama, M. (2005). Enterprise vulnerability management and its role in information security management. Information Systems Security, 14:29–56.
Red Hat (2021). Kubernetes adoption, security, and market trends report 2021s. [link].
Robinson, R. and Fishbein, N. (2021). New attacks on kubernetes via misconfigured argo workflows. [link].
Seals, T. (2021). ‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise. [link].
Shamim, M. S. I., Bhuiyan, F. A., and Rahman, A. (2020). Xi commandments of kubernetes security: A systematization of knowledge related to kubernetes security practices. 2020 IEEE Secure Development (SecDev), pages 58–64.
Takahashi, K., Aida, K., Tanjo, T., and Sun, J. (2018). A portable load balancer for kubernetes cluster. In Proceedings of the International Conference on High Performance Computing in Asia-Pacific Region, HPC Asia 2018, page 222–231, New York, NY, USA. Association for Computing Machinery.
Wilkens, F., Haas, S., Kaaser, D., Kling, P., and Fischer, M. (2019). Towards efficient reconstruction of attacker lateral movement. In Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES ’19, New York, NY, USA. Association for Computing Machinery.
David, R. B. and Barr, A. (2021). Kubernetes autoscaling: Yoyo attack vulnerability and mitigation. In CLOSER.
Jensen, N. and Miers, C. C. (2020). Segurança de contêineres: taxonomia baseada na arquitetura. In Anais da XVIII Escola Regional de Redes de Computadores, pages 128–134, Porto Alegre, RS, Brasil. SBC.
Kronser, A. (2020). Common vulnerabilities and exposures : Analyzing the development of computer security threats. Master’s thesis, Helsingin yliopisto.
Kubernetes (2021). Kubernetes documentation. https://kubernetes.io/docs.
Marathe, N., Gandhi, A., and Shah, J. M. (2019). Docker swarm and kubernetes in cloud computing environment. In 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), pages 179–184.
Mercl, L. and Pavlik, J. (2018). The comparison of container orchestrators.
Minna, F., Blaise, A., Rebecchi, F., Chandrasekaran, B., and Massacci, F. (2021). Understanding the security implications of kubernetes networking. IEEE Security Privacy, pages 2–12.
MITRE (CVE Terminology) (2021). Cve terminology. https://cve.mitre.org/about/terminology.html.
Nyanchama, M. (2005). Enterprise vulnerability management and its role in information security management. Information Systems Security, 14:29–56.
Red Hat (2021). Kubernetes adoption, security, and market trends report 2021s. [link].
Robinson, R. and Fishbein, N. (2021). New attacks on kubernetes via misconfigured argo workflows. [link].
Seals, T. (2021). ‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise. [link].
Shamim, M. S. I., Bhuiyan, F. A., and Rahman, A. (2020). Xi commandments of kubernetes security: A systematization of knowledge related to kubernetes security practices. 2020 IEEE Secure Development (SecDev), pages 58–64.
Takahashi, K., Aida, K., Tanjo, T., and Sun, J. (2018). A portable load balancer for kubernetes cluster. In Proceedings of the International Conference on High Performance Computing in Asia-Pacific Region, HPC Asia 2018, page 222–231, New York, NY, USA. Association for Computing Machinery.
Wilkens, F., Haas, S., Kaaser, D., Kling, P., and Fischer, M. (2019). Towards efficient reconstruction of attacker lateral movement. In Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES ’19, New York, NY, USA. Association for Computing Machinery.
Publicado
27/10/2021
Como Citar
JENSEN, Nikolas; MIERS, Charles C..
Uma análise das vulnerabilidades de segurança do Kubernetes. In: ESCOLA REGIONAL DE REDES DE COMPUTADORES (ERRC), 19. , 2021, Charqueadas/RS.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2021
.
p. 67-72.
DOI: https://doi.org/10.5753/errc.2021.18544.
