Pentesting DevOps: Attacking Containers and Container Orchestration
Mark Manning
Length: 50 Minutes
Location: Track 1 at 1500
Talk Description: Monolithic applications are a thing of the past but our job as security professionals is to review them from a security perspective. This talk will review container technologies (e.g. Docker, LXC) as well as container orchestration technologies (e.g. Kubernetes, Marathon). We will cover new container-centric OS's like CoreOS and what security implications exist for each. What is their threat model? What does a "pen test" against these technologies really mean? We'll include real-world exploit scenarios we've seen in client environments.
Bio: Mark Manning is a Principal Security Consultant with NCC Group with a focus on enterprise devops and container technologies. He has worked with numerous clients on Docker, Mesos, Rancher, CoreOS, Kubernetes, and other container-related technologies. He's performed penetration tests to breakout from container to host, architecture review of devops and container orchestration systems, and research on container technologies. Mark also works on mobile applications, general application security, and security reviews of privacy and pseudonymity technologies like Tor. He also is a BSidesROC and Rochester 2600 organizer.
