Spanning over 4 days with more than 500 different sessions all focused on cloud-native and Kubernetes, it’s easy to say that this is an event of inspiration, learning, and exploration.
At Irori, we work a lot with K8s, overall cloud and particularly the security aspects of K8s. So, for our trip to KubeCon + CloudNativeCon this year, we singled out interesting security talks and sessions. And so, here is our summary of the conference with a special focus on security!
Interested in something specific, go directly to your favorite topic:
- Policy as Code
- “Shift Down” Security
- Developer-Introduced Credential Leaks
- Supply Chain Security
- Attestation and Attestators
- Open Source Security Challenges
Policy as Code
Policy as Code (PaC) was mentioned a lot this year. Instead of relying on traditional static policy documents, PaC involves codifying policies and managing them through version control, which effectively makes it easier to evaluate and uphold policies consistently across an organization’s IT landscape. Tools like Open Policy Agent (OPA), Gatekeeper, Kyverno, and Istio have been around for a while, but the community is still pushing new features continuously! The takeaway here is that PaC allows organizations to remove the guesswork from policy management, being able to automatically manage, enact, and update policies across CI/CD pipelines, staging, and production clusters without much added cost and while maintaining tight security. As always, some limitations exist; for example, Rego, the policy language, is still evolving, and integrations are still being added.
“Shift Down” Security
Embedding security measures directly into the underlying platform to alleviate the burden on developers AKA Shift Down Security. This approach recognizes that developers, while crucial in the security process, may not always possess specialized security expertise. By building security into the platform through automation and policy enforcement, organizations can create an environment that is secure by default, empowering developers with self-service capabilities without compromising overall security. Platform engineering teams play a key role in implementing this strategy by addressing cross-cutting security concerns at the platform level, such as vulnerability management, misconfiguration prevention, and supply chain security. Key takeaway here is that Shift Down security complements but not replaces Shift Left ,meaning that security awareness and best practices among developers is still important. If you want to start moving towards a Shift Down Security practice, we recommend you look into any of these tools: KubeScape , Harbor , Snyk, Backstage or Kpack! Important to note that Shift Down Security moves responsibility and expectations from the developers and instead requires the platform team to be quite security conscious, so consult your colleagues before diving too deep into this =D
Preventing Developer-Introduced Credential Leaks
GitHub found 39 million secrets leaked during 2024 and the increasing use of AI coding assistants might inadvertently contribute to even higher numbers this year. This year this was highlighted as a key issue within security and really emphasised the need for improved development processes and tools to prevent these exposures. Least privilege, rotating and revoking secrets and automating secret management processes were some of the best practices shared during sessions. Tools like GitHub’s secret scanning and push protection which detects secrets before they are committed to repositories is crucial for preventing accidental exposures. However, the inherent difficulty in detecting all types of secrets like generic ones still poses the biggest challenge here and so being aware of the human element is important.
Supply Chain Security
Discussions during the days highlighted the growing adoption of standardized Software Bill of Materials (SBOMs) formats like SPDX and CycloneDX to facilitate interoperability and wider use. Furthermore, the concept of KBOM (Kubernetes Bill of Materials) was talked about, focusing on the components of the Kubernetes cluster itself, signifying a broader approach to supply chain security in the cloud-native ecosystem. KBOM enhances visibility into the composition of a Kubernetes cluster allowing users to gain a better understanding of their ecosystem and proactively assess the security posture and potential vulnerabilities.
Attestation and Attestators
Attestators provide cryptographically signed attestations, which are verifiable statements about the software, such as who built it, when it was built, and the processes followed. These attestations act as proof that the software was built and deployed in a secure and compliant manner. Tools like TUF and in-toto are being used to sign and verify SBOMs and other metadata, ensuring that artifacts remain tamper-evident throughout the CI/CD pipeline. For instance, a policy might require that all container images have an attestation from the CI/CD system verifying the build process and the source code used. The increasing emphasis on attestation this year reflects a growing recognition of the importance in establishing a more secure and trustworthy software supply chain.
Open Source Security Challenges
The use of open-source software introduces unique security challenges, and this year’s event addressed the rising threat of spear-phishing attacks targeting developers through open-source package managers like npm and pip. Attackers are increasingly targeting maintainers of popular open-source packages to inject malicious code. These attacks often involve sophisticated social engineering tactics, where attackers may impersonate legitimate contributors or use AI-powered tools to craft convincing phishing messages. There is also a large number of github repos, npm and pip packages created each week with fake stars and downloads to trick users that they are legit and safe. There was no actionable strategies or tools to counter these threats but a lot of discussions revolved around this with the hope to highlight the risk and awareness.
Conclusion
These were just some of the insights we took with us after spending four days at KubeCon + CloudNativeCon this year. The discussions and sessions we attended gave us ideas and we now look forward to continuing to dig deeper into these areas and seeing how the security landscape evolves going forward.
See you next year at KubeCon + CloudNativeCon!
