Behold, the behemoth that is called the NIST Cybersecurity Framework.
Framework is divided into three parts, Core, Profile, and Tiers.
The Framework Core that is currently on the screen contains high‑level best
practices for cybersecurity and risk management in general.
Kube‑hunter primarily sits within the Detect and Respond functions.
Let's dive into this a little bit more.
The NIST Framework defines categories for every function.
Kube‑hunter primarily sits within two categories,
Anomalies and Events, and Analysis.
As a brief aside,
I'm going to quickly go through the Framework sections so we
can get to the demos as quickly as possible.
First off, detected events are analyzed to understand attack targets and methods.
An example of this is going to be seen within our demo environment.
Specifically,
we're going to use kube‑hunter to understand how our
Kubernetes cluster was compromised.
It's going to be pretty awesome.
And also the impact of the incident is understood.
MITRE ATT&CK coverage for kube‑hunter is going to center
upon the Infrastructure Analysis area.
For the purposes of this course,
we'll focus our defense on three attack techniques.
System Services, in other words,
adversaries may abuse system services or daemons to
execute commands or programs.
In this course, we will investigate a misconfigured Kubernetes daemon.
Exploitation of Privilege Escalation.
We will also investigate how an attacker can interact
with the host from within a container.
It's going to be great.
And also Implant Container Image.
In our demo environment,
we will also explore how a Docker image registry can be compromised.
We can think of a Docker image registry as a place where an
organization's Docker images are restored.
Let's dive into each in more detail.
Here we see the MITRE ATT&CK technique and a mapping
to the MITRE Shield active defense.
In other words,
the attack categories in this course can be mitigated by these active defenses.
System services maps to the API Monitoring active defense.
In other words,
a defender can monitor operating system function calls to
look for adversary use and/or abuse.
Exploitation of Privilege Escalation maps to the admin access active defense.
Here,
a defender can configure system users to not have administrative access in
order to ensure privilege escalation requires exploitation.
And last but not least, Implant Container Image.
This maps to the behavioral analytics active defense,
where a defender can monitor user interactions with images and containers to
identify ones that have been added or altered anomalously.
In this course,
we're going to run a few Docker commands that can show
signs of Docker image tampering.