/Recent content on Tim AllclairHugo -- gohugo.ioen-usTue, 19 Nov 2019 00:00:00 +0000/talks/20191119-walls-within-walls/Tue, 19 Nov 2019 00:00:00 +0000/talks/20191119-walls-within-walls/What happens if an attacker escapes a container and compromises your node? Is it game over for the whole cluster, or can you limit the blast radius? Whether it be for defense in depth or multi-tenancy, it is important to understand the security boundaries in your cluster. In this talk, we’ll discuss various isolation approaches and evaluate them through the eyes of an attacker who has compromised a node and is looking to propagate./talks/20191118-state-of-security/Mon, 18 Nov 2019 00:00:00 +0000/talks/20191118-state-of-security/Last year we presented on the state of Kubernetes Security across the past, present, and future. This year, we’ll continue that tradition by: Reviewing the major security vulnerabilities and milestones of 2019 Reviewing progress on the Big Problems we highlighted in 2018, and highlighting other work in progress Looking forward to 2020 with predictions of major themes and open issues/talks/20181211-recent-advancements-in-container-isolation/Tue, 11 Dec 2018 00:00:00 +0000/talks/20181211-recent-advancements-in-container-isolation/Container orchestration enables higher bin-packing and utilization of machines, but native linux containers do not offer the same degree of isolation between workloads as separate VM instances can. Attackers could abuse this lack of isolation to move through a Kubernetes cluster after gaining a foothold in a container. Fortunately, there are many tools in the defenders’ toolbox that can be applied across multiple levels of the stack. In this survey talk, we will look at several recent or upcoming advancements in container isolation./talks/20181210-state-of-security/Mon, 10 Dec 2018 00:00:00 +0000/talks/20181210-state-of-security/First, we’ll stroke your egos by reviewing the history of Kubernetes security and marvelling in the progress we’ve made. Next, we’ll examine some of the hottest new features, and how you might be affected. We’ll conclude with a call to arms by highlighting a few of the most gnarly issues on the horizon./talks/20181115-layers-of-isolation/Thu, 15 Nov 2018 00:00:00 +0000/talks/20181115-layers-of-isolation/How much isolation can you reasonably expect between two applications in the same cluster? Should every application have its own namespace? Every service? Between containers, pods, nodes, namespaces, and even clusters, it can be hard to know how to architect a secure system, and what layers of isolation can be depended on. In this talk we will start at the bottom and build up. You will learn which resources are isolated between two containers in the same pod, and which are not./talks/20180504-secure-pods/Fri, 04 May 2018 00:00:00 +0000/talks/20180504-secure-pods/What is a “secure pod”? What does it mean for a Kubernetes workload to have strong isolation? With the announcement of Kata Containers and the overflowing multitenancy deep-dive at the last Kubecon, it’s clear that these topics are building momentum. This talk will cover the current state of container isolation and why there is a need for technologies like hypervisor-based containers in order to provide stronger security boundaries. It will also include a discussion of how these technologies fit into Kubernetes and a roadmap for secure pods./about/Sun, 29 Oct 2017 00:00:00 +0000/about/My name is Tim Allclair (né St. Clair). I am a software engineer at Google working on Kubernetes. Aside from software engineering and computer security, I enjoy lots of hobbies including piano, woodworking, backpacking, birding, juggling, photography, meditation, and many more… @tallclair @tallclair tim-allclair stackoverflow timallclair@gmail.com PGP Key: [4096R/0x5E6F2E2DA760AF51] --