Security Testing

Vulnerability scanning with kube-hunter, kube-bench, and AWS security tools.

This page details our security verification processes, covering Kubernetes cluster auditing (using kube-hunter and kube-bench) and AWS cloud-native security controls.

Kubernetes Security Auditing

We perform automated security scanning inside our Kubernetes clusters to identify container vulnerabilities and configuration compliance issues.

1. Weakness Scanning with `kube-hunter`

kube-hunter hunts for security weaknesses in Kubernetes clusters. By running it inside a pod, we can discover what a compromised or malicious container can access/exploit within the cluster network.

Running as a Kubernetes Job

We define a job.yaml that executes kube-hunter in a container:

Deploy the scanner job:
bash
```
kubectl create -f ./job.yaml
```
Find the scanner pod name:
bash
```
kubectl describe job kube-hunter
```
View the vulnerability report:
bash
```
kubectl logs <pod-name>
```

2. CIS Benchmark Auditing with `kube-bench`

kube-bench checks whether Kubernetes is deployed securely by running checks against the official CIS Kubernetes Benchmark standards.

Running as a Kubernetes Job

To verify master node and API server configurations:

Apply the benchmark job:
bash
```
kubectl apply -f job.yaml
```

Track the job status:

bash

kubectl get pods --selector=job-name=kube-bench

Analyze the compliance logs:

bash

kubectl logs kube-bench-j76s9

Expected Output example:

text

[INFO] 1 Master Node Security Configuration
[INFO] 1.1 API Server Configuration
[PASS] 1.1.1 Ensure that the --anonymous-auth argument is set to false
...

AWS Infrastructure Security

In our cloud environments, security verification and active monitoring are handled by AWS native services.

1. AWS Security Hub

Security Hub continuously monitors and evaluates our AWS resource configurations against compliance frameworks (such as CIS AWS Foundations, PCI-DSS).

Function: Aggregates findings from AWS Config, GuardDuty, Inspector, and third-party tools.
Benefit: Provides a single score indicating overall security posture and lists remediation steps for misconfigured resources.

2. Amazon GuardDuty

GuardDuty provides intelligent threat detection across our AWS accounts and workloads.

Data Sources: Analyzes VPC Flow Logs, DNS logs, and CloudTrail event logs.
Detection: Uses machine learning and threat intelligence to identify compromised instances, suspicious API calls, malware, and potential data exfiltration paths.

3. AWS WAF (Web Application Firewall)

AWS WAF protects our public-facing services (ALBs, API Gateways, CloudFront) from common web exploits.

Rulesets: Enforces managed OWASP Top 10 protection rules.
Protections: Blocks SQL injection (SQLi), Cross-Site Scripting (XSS), and implements rate limiting to mitigate DDoS or bot attacks.