🧀 Swiss Cheese Kubernetes Defence

I regularly do Kubernetes security reviews.

And I always find gaps.

So why bother?

Enter the Swiss Cheese Model for Kubernetes clusters!

Hardware failure and attackers (figure, left) will threaten the confidentiality, integrity and availability of customer data (figure, right).

Most of the security measures we take have holes:

• Access control lists are sometimes out-of-date or too broad.
• Some containers needs to run as root.
• Suspicious log entries are missed.
• etc.

Holes are constantly created due to:

• External pressures, e.g., deadline – no need to secure a platform that no one wants to use.
• External changes, e.g., Kubernetes and the CNCF landscape changes rapidly.
• Human errors: We all have bad days and fat fingers.

A security review will ensure both:

• that security gaps are found and prioritized;
• that many defenses exist, so no single gap can compromise data security.

What about you?

Any layers I should add? Please share your story by commenting on this LinkedIn post.