Introduction

Welcome to Attacking & Auditing Docker Containers & Kubernetes Clusters training.

  • This attacker focused, hands on training will set you on path to understand common vulnerabilities in containerized environments (Docker) and get familiar with Kubernetes clusters
  • It will help you to learn the approach to follow and the process for testing and auditing containers and Kubernetes clusters
  • By the end of the training participants will able to identify and exploit applications running on containers inside Kubernetes clusters with a hands-on approach

Abstract

An organisation using microservices or any other distributed architecture rely heavily on containers and container orchestration engines like Kubernetes and as such its infrastructure security is paramount to its business operations.

This course will set the base for security testers and DevOps teams to test for common security vulnerabilities and configuration weaknesses across containerised environments and distributed systems. It also helps to understand approach and process to audit the Kubernetes environment for security posture.

The courseware is meant to introduce participants to container and cluster management with Kubernetes.

  • The focus is on the security aspects of application and the container infrastructure
  • The participants will learn the common tools and techniques that are used to attack applications running in containerized environments
  • The participants will be introduced to Kubernetes and learn to assess the attack surfaces applicable for a given application on the cluster
  • The participants will learn how to audit for security based on best practices using tools and custom scripts

As part of the course delivery, the trainer will share examples of real world security issues found in penetration testing engagements to showcase mapping of the concepts with what usually happens in the real world.

Hardware Requirements

  • At least 8 GB of RAM, 10GB of Diskspace free on the system
  • Laptop should support hardware-based virtualization
    • If your laptop can run a 64-bit virtual machine in Oracle VirtualBox it should work
  • Network Connectivity or USB Ports for copying data
  • Trainer will provide the VM and dedicated Kubernetes cluster configuration for each student with administrative access to have a hand-on experience during the training

Prerequisites

  • Basic knowledge of using the Linux command line
  • System administration basics like servers, applications configuration and deployment
  • Familiarity with container environments like Docker and distributed systems would be useful

Take Aways

  • Complete hands-on training with a practical approach and real-world scenarios
  • Ebooks of the training covering all hands-on in a step by step guide (HTML, PDF, EPub, Mobi)
  • Git repository of all the custom source code, scripts, playbooks used during the training
  • Resources and references for further learning and practice