Security for Anthos and Google Kubernetes Engine | Former pentester, DFIR and OS X security | he/him | Mostly posting on https://nitter.cf/t.co/mUfMpB1DJv now
Joined July 2010
- Tweets455
- Following653
- Followers1.6K
- Likes485
Pinned Tweet
Super excited to be giving a keynote at #CNSCon with @_techcet_ in Seattle! We're going to talk about Ray.io security when running on K8s, and AI/ML security on K8s generally: sched.co/1dCVC. June is a magical time to be in the PNW, see you there!
Don't miss @mrgcastle of @Google rocking the stage at #CNSCon North America, June 26-27 in Seattle! Dive into a lineup of trailblazers & explore the future of #CloudNative & #security: hubs.la/Q02x5dvm0. Register by May 19 & save US$350: hubs.la/Q02x5c3V0.
Yeah this is great. I also love how the UI design shoves the "more tweets" content engagement farm into your face each time you're forced into clicking "show probable spam" to read any thread.
"You were born to deploy kubernetes clusters" youtu.be/ia8Q51ouA_s?si=Y8kE…
The security community on twitter feels smaller and quieter these days. If you were following me for K8s/GKE/Container security content I'm going to try using linkedin instead, find me here: linkedin.com/in/greg-castle/
Spotify runs most of their production workloads on GKE and wrote this cool post on memory #forensics. They suck out memory through a privileged pod via kcore and send it to #volatility for analysis. engineering.atspotify.com/20…
Overating vulns causes tons of pain for the huge number of companies operating under a patching SLO. Unfortunately NVD has a rich history of vulnerability severity inflation.
NVD: this CVE has a score of 9.8.
The maintainers and pretty much every other competent security expert: this is 0.0 at best and should be rejected.
nvd.nist.gov/vuln/detail/CVE…
If you find yourself trying to convince others of the security benefits in keeping K8s clusters patched and up-to-date, this blogpost is for you. Here’s a quick summary… (1/6)
cloud.google.com/blog/produc…
To be notified when to patch serious vulnerabilities, you can subscribe to the security bulletin pubsub which will notify you as soon as a patch is available for that specific cluster. (5/6)
Google Cloud is hiring security engineers in the Product Security Assurance team (not my team but we work with them closely). Find and fix vulns, help products build in security by default. Seattle and Bay Area. #infosecjobs careers.google.com/jobs/resu…
This report is a pretty nice collection of post exploitation recon and privesc commands on Windows. It's been a long time since my windows pentesting days and I kinda hoped the "own one box get the whole domain" thing was better by now ☹️ media.defense.gov/2023/May/2…
“Don’t run containers as root”: we’ve been saying this for a long time. Is it working?
No.
@vglovespizza and I gave a talk at #KubeCon EU about our journey converting GKE system containers to non-root that explains why.
Here’s a summary… (1/8)
youtu.be/uouH9fsWVIE
Talk recording: youtu.be/uouH9fsWVIE.
Slides: static.sched.com/hosted_file… (8/8)