Notes about information security, written by Feroz Salam.
A while ago, for reasons that I no longer remember clearly, I spent some time investigating the differences between different configurations of Docker containers and the implications they had on the Linux capabilities the resulting containers would have. I find that advice around Docker security is often a bit muddled – a common occurrence of this confusion is the use of ‘privileged’ and ‘root’ as…
If you’re setting up GKE audit logging, you are probably following the instructions on this page . It describes two levels of audit logging that are available via GCP: the ‘Admin Activity log’ and the ‘Data Access log’. The documentation says: Admin Activity logging is enabled by default and has no extra cost. Data Access logging is disabled by default, and enabling it can result in extra billing.…
Over the last few months I have been speaking to a variety of companies about joining their security teams. If you’ve done any software interviews, you’re probably pretty familiar with how these things go: an hour is usually divided into two parts, the first part being roughly 45 minutes long, with the interviewers asking you questions. The second part is left for you to ask any questions you…
One week ago, I passed the exam for the Certified Kubernetes Administrator (CKA) certification. My eventual goal is the Certified Kubernetes Security Specialist (CKS), for which the CKA is a prerequisite. There are many descriptions of the CKA exam process on the internet, but not that many from a security engineering perspective, so I thought it might be useful to discuss how I found the course,…
Earlier today, Cloudflare announced support for ODoH , a new protocol that (somewhat) solves the problem of having to place significant trust in your DoH provider. The solution involves leveraging a proxy to pass on your request in such a manner that the proxy doesn’t know what your request is, and the DNS resolver doesn’t know who you are. The solution is not perfect - if the proxy and the…
One of the engineering questions that’s been preoccupying me over the last few months at Thought Machine has been about the most effective way to maintain a large library of detection rules for security events. We use ElastAlert extensively for our detection libraries, in part because it offers us the ability to put our detections into code. Our ElastAlert deployments run in immutable containers,…
This post refers to an early version of elastalert-ci, and technical implementation details mentioned below may not apply. Please read the README on the project repository for accurate information on how to use elastalert-ci within your project. When I wrote my original post on unit testing for ElastAlert earlier this year, I cunningly didn’t go into very much detail on how a user should create…
For the last few months, Wireguard has been mysteriously broken on my personal laptop. I hadn’t touched the configuration, and my other devices were working perfectly, but packets from my laptop were no longer reaching my Wireguard server. I finally decided to sit down and crack the problem today. After a couple of hours spent in the unhappy company of dmesg , tcpdump and various reboots, I have a…
GKE and EKS forward audit logs from the Kubernetes API server to Cloud Audit Logs and Cloudwatch respectively. Unfortunately, however, the logs from each provider have a marginally different format, which means that you can’t simply apply the same rules to logs from both sources indiscriminately. Taking a single operation - the creation of an nginx pod - in a vanilla installation of GKE and EKS, I…
For a project that Marco and I have been working on, we have recently had a need to examine Kubernetes audit logs. In order to simplify and standardise the process of creating a small k8s environment that generates Kubernets audit logs, I have created a Vagrant box that: Sets up microk8s with audit logging configured Loads a custom audit policy Sets up Elasticsearch and Kibana to ship logs to Sets…