---
title: "A threat-informed roadmap for securing Kubernetes clusters (KubeCon EU 2024)"
description: "How to prioritize Kubernetes security controls based on attacks happening in the wild."
author: "Christophe Tafani-Dereeper, Frederic Baguelin"
date: 2024-03-22
category: "research"
tags: ["kubernetes", "container security"]
url: "https://securitylabs.datadoghq.com/articles/threat-informed-roadmap-kubernetes-kubecon-eu-2024/"
---

Yesterday at KubeCon EU 2024, we presented a talk [Keep Hackers Out of Your Cluster with These 5 Simple Tricks](https://kccnceu2024.sched.com/event/1YeRs). We have published a written version of our research as a guest post on tl;drsec, a well-known security newsletter for practitioners.

> Many options are available to increase the security posture of a Kubernetes cluster. But which ones to prioritize, and why? In this talk, we take a data-based and threat-informed approach to prioritizing security investments. We start by describing the attacks we've seen over the past year on a network of Docker and Kubernetes honeypots we've deployed publicly-facing on the internet, mimicking the Docker API, Kubernetes API server, and Kubelet API to catch what attackers are doing in the wild. Then, we review several high-profile container escape vulnerabilities and how they've been exploited in the wild. Based on this, we list the most common ways attackers attempt to deploy malicious workloads, backdoor a cluster, or escape containers—and what are the most effective and "bang for your buck" security mechanisms that you can implement in your own cluster.

[**Read the blog post on the tl;dr sec website**](https://tldrsec.com/p/kubernetes-security-threat-informed-defense), get the [slides](https://docs.google.com/presentation/d/1FDzzxo7U_890_nHZyNK9L3XNisqao5aVyJrqI1ntgmE/edit#slide=id.g2c3c3dab940_0_481) or watch the [recording](https://www.youtube.com/watch?v=UZz44j8bszU).

[![](https://securitylabs.dd-static.net/img/threat-informed-roadmap-kubernetes-kubecon-eu-2024/hero.png?auto=format)](https://tldrsec.com/p/kubernetes-security-threat-informed-defense)