<story><title>NSA Kubernetes Hardening Guidance [pdf]</title><url>https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF</url></story><parent_chain><item><author>sound1</author><text>I am mostly non technical person but why do we need to resort to firewalls etc. if we can employ UNIX like file permission system for network access? Wouldn&amp;#x27;t it be awesome if we can allow any installed software to contact ONLY whitelisted domains? Of course this excludes web browsers but you get the idea.&lt;p&gt;How about our mainstream OSes incorporate that kind of permission system similar to what we have in mobile OSes already have today?</text></item><item><author>beprogrammed</author><text>- Scan containers and Pods for vulnerabilities or misconfigurations.&lt;p&gt;- Run containers and Pods with the least privileges possible.&lt;p&gt;- Use network separation to control the amount of damage a compromise can 
cause.&lt;p&gt;- Use firewalls to limit unneeded network connectivity and encryption to protect 
confidentiality.&lt;p&gt;- Use strong authentication and authorization to limit user and administrator 
access as well as to limit the attack surface.&lt;p&gt;- Use log auditing so that administrators can monitor activity and be alerted to 
potential malicious activity.&lt;p&gt;- Periodically review all Kubernetes settings and use vulnerability scans to help 
ensure risks are appropriately accounted for and security patches are applied.</text></item></parent_chain><comment><author>bennysaurus</author><text>It&amp;#x27;s a fair question and certainly is possible to have firewalls on a per-server basis. We do that for incoming traffic primarily. The catch is if that server itself gets compromised then you can&amp;#x27;t count on those rules still being enforced.&lt;p&gt;Having dedicated network appliances acting as firewalls means from a security perspective you need to compromise the local machine and then also compromise a dedicated, hardened external system as well. It vastly ups the difficulty barrier.</text></comment>
<story><title>NSA Kubernetes Hardening Guidance [pdf]</title><url>https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF</url></story><parent_chain><item><author>sound1</author><text>I am mostly non technical person but why do we need to resort to firewalls etc. if we can employ UNIX like file permission system for network access? Wouldn&amp;#x27;t it be awesome if we can allow any installed software to contact ONLY whitelisted domains? Of course this excludes web browsers but you get the idea.&lt;p&gt;How about our mainstream OSes incorporate that kind of permission system similar to what we have in mobile OSes already have today?</text></item><item><author>beprogrammed</author><text>- Scan containers and Pods for vulnerabilities or misconfigurations.&lt;p&gt;- Run containers and Pods with the least privileges possible.&lt;p&gt;- Use network separation to control the amount of damage a compromise can 
cause.&lt;p&gt;- Use firewalls to limit unneeded network connectivity and encryption to protect 
confidentiality.&lt;p&gt;- Use strong authentication and authorization to limit user and administrator 
access as well as to limit the attack surface.&lt;p&gt;- Use log auditing so that administrators can monitor activity and be alerted to 
potential malicious activity.&lt;p&gt;- Periodically review all Kubernetes settings and use vulnerability scans to help 
ensure risks are appropriately accounted for and security patches are applied.</text></item></parent_chain><comment><author>zeroxfe</author><text>Think of them as a defence-in-depth that protect from accidental misconfiguration, software bugs, local exploits, etc.</text></comment>