DUSTIN KIRKLAND: My name's Dustin Kirkland.
I'm a product manager at Google, and I'm here
with Maya Kaczorowski, also a product manager at Google.
And she knows everything about security--
MAYA KACZOROWSKI: I certainly don't know everything
about security.
DUSTIN KIRKLAND: Enough that we're
going to talk about security.
MAYA KACZOROWSKI: Sounds good.
DUSTIN KIRKLAND: Especially the security vulnerabilities space
around Kubernetes.
What interesting vulnerabilities have you seen recently?
MAYA KACZOROWSKI: Yeah, in the last couple of months,
we've had a couple of interesting vulns.
So let's look at 2019.
There was a RunC vulnerability earlier this year,
which was, effectively, a container escaped.
And then more recently, the Alpine images had a--
newer versions have a root default password,
which is kind of scary-looking.
DUSTIN KIRKLAND: And what was that password, just so we know?
MAYA KACZOROWSKI: I think it was just null.
DUSTIN KIRKLAND: I think it was null.
I think you're exactly right.
MAYA KACZOROWSKI: Yeah, which is terrifying.
And then obviously, we've also had
some additional speculative execution vulnerabilities
that have been announced.
So lots of things affecting the kernel and OSs
and the Kubernetes space recently.
DUSTIN KIRKLAND: Yeah, and what are we learning?
Are we learning anything from this,
trying to make Kubernetes and our space better?
MAYA KACZOROWSKI: I think one thing we've really realized
is that Kubernetes is actually really good at managing patches
and vulnerabilities, right?
Kubernetes has a product security team
that handles Kubernetes-specific vulns.
And then probably your cloud provider
is managing a lot of that stuff for you.
On GCP, we manage the patches for you,
and you can check out the security bulletins
to see how you've been patched.
But we're also seeing a lot of interest
from security researchers in the space
and seeing what's going on and can they
exploit these vulnerabilities in live environments?
So the RunC vuln had proofs of concept
available within a matter of days.
DUSTIN KIRKLAND: OK.
MAYA KACZOROWSKI: And the--
DUSTIN KIRKLAND: And how quickly were patches available?
MAYA KACZOROWSKI: Patches were available--
so it was embargoed, and at announcement the patches
were available.
DUSTIN KIRKLAND: OK, good, good.
MAYA KACZOROWSKI: And the Alpine images,
a security researcher recently found out that 20% of them--
20% of the top Docker Hub images were using the null password,
which is absolutely terrifying.
DUSTIN KIRKLAND: Wow.
So that's Kubernetes itself.
What about the applications inside of Kubernetes?
How are we approaching this in a modern containerized software
world that--
I don't know, hopefully is a little bit better
than prior generations of software?
MAYA KACZOROWSKI: Yeah, that's a good point.
I think people just-- they think of attacks on containers
as being only one category.
But you can split it up between attacks on the infrastructure,
like towards the Kubernetes API server, versus attacks
on applications which just happen
to be running in containers.
DUSTIN KIRKLAND: Right.
MAYA KACZOROWSKI: And so for applications
that happen to be running in containers,
we're not seeing attacks in the wild that
are significantly different or significantly more common
than you would see in any other environment.
What's happening is people are looking--
attackers are lazy, right?
They're looking for vulnerabilities
that have been unpatched for years
and seeing if they can exploit those,
and they don't seem to care whether or not it's
a containerized application.
DUSTIN KIRKLAND: Would it be fair to say
that modern CI/CD and the way we use that in Kubernetes
should be helping our ability to patch safely and reliably?
MAYA KACZOROWSKI: It should, right.
If you think about a container, you're
not patching a live container.
You're actually patching a container that sits in a--
an image that sits in a registry and then rebuilding
and redeploying that container.
So patching becomes as easy for you
to implement as your typical--
your normal rollout process.
So you can actually patch something with the same canary
testing, deployment, all those tools
that you would use anyway and make it much safer than you
would otherwise.
What that should mean in theory, although not
always in practice, is that you should be able to patch
more often and patch more easily than you would've
been able to do before.
DUSTIN KIRKLAND: And do you think we're seeing that yet?
MAYA KACZOROWSKI: I think we are.
I hear of some customers who are tearing down
their entire environment and redeploying it every x hours, x
days, for sure.
DUSTIN KIRKLAND: Right, GKE and security,
what are some of the things we're doing to push
the envelope in that space?
MAYA KACZOROWSKI: Sure, so at our recent Next conference,
Google Cloud announced a couple of things.
We have binary authorization, which
is our way of enforcing that containers
meet certain requirements before they
get deployed to production.
CGR vulnerability scanning, this is
related to what we were just talking
about around patching things before they end up
in production so you actually can apply certain patches.
It lets you scan images in your repository
for known vulnerabilities.
And we just announced GKE Sandbox
in beta, which is using Google's gVisor technology to help you
isolate untrusted code in your environment
in multi-tenant environments.
And of course, we're working on more
but I don't have anything to share right away.
DUSTIN KIRKLAND: All right.
Maya, thank you very much.
MAYA KACZOROWSKI: Thank you so much.
[MUSIC PLAYING]