# Adopting Zero Trust for Kubernetes


A lot of things have changed as a result of the COVID 19 Pandemic. Due to it, the IT business has had to move at a very quick rate, and now it is common for people to work from home. Now, more than ever before, businesses are working to put into place a variety of security policies and procedures that will ensure the complete safety of their organization's assets.

A strategy approach in cybersecurity known as "[Zero Trust](https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/)" protects a business by removing all forms of implicit confidence and continuously validating each stage of a digital connection. This method is designed to keep hackers out. To put it another way, the idea behind this is that you should never believe anything without first checking it out: "Never Trust Always Verify."

Utilizing robust authentication and authorization procedures at each level enables the organization to safeguard modern and evolving environments while also facilitating digital transformation. This is one of zero trust's primary purposes. It protects the network in multiple ways, including by segmenting the network, blocking lateral movement, offering [Layer 7 threat prevention](https://datadome.co/learning-center/ddos-layer-7-security-protection/), and simplifying granular "least access" regulations.

Traditional security models that are used today are based on the antiquated assumption that everything contained within an organization's network ought to be implicitly trusted. Because of this implicit trust, once users are connected to the network, they have complete freedom to move laterally and access or exfiltrate critical data. There are no granular security measures to prevent them from doing so. The flaws discovered in this system led to the development of the Zero Trust model. 

Is the Zero Trust Architecture Really Necessary?
------------------------------------------------


[Source](https://www.sentinelone.com/blog/moving-to-a-zero-trust-security-model/)

The infrastructure of a company today includes Kubernetes, containers, and microservices. These are essentially developed with a variety of different components, including the CI/CD infrastructure and additional features like handling user queries, databases, etc. These components consequently make up a significant part  of an organization's infrastructure. Thus, securing them using the Zero Trust model will benefit both the company and the users.

The Zero Trust model adheres to the principle of applying the same security standards to personally owned devices as those controlled by the organization. Devices belonging to the company, as well as those belonging to contractors, partners, and guests, are treated in the same manner regardless of whether the device itself is fully managed by IT or whether only the apps and data are secured.

There are some other modifications, such as the implementation of passwordless authentication, which substitutes the conventional password with two or more verification elements, such as single sign-on with two-factor authentication (SSO with 2FA) or an OTP that is transmitted directly to the user's device.

Adopting Zero Trust for Kubernetes Environment
----------------------------------------------

When discussing the implementation of Zero Trust on Kubernetes, there are a number of things that must be done, including correct authentication, authorization (which essentially refers to the admission controller), and auditing and logging only for adequate monitoring.

There are numerous approaches that can be used. Before anything else, we must properly authenticate all users and verify their roles. These tasks can be completed manually or with the use of a tool. For this tutorial, to locate the bottlenecks in our deployed infrastructure, we will be using [Kubescape Cloud](https://cloud.armosec.io/) by Armosec.


Kubescape allows you to perform role-based access control, validate containers that are running with high privileges, and a great deal of other things such as image and repo scanning. So without further ado, let's see how to install and use Kubescape to enforce zero trust on our Kubernetes system.

Installing Kubescape is fairly simple - all you need to do is sign up for an account. Signing up can be done in a variety of ways, either through Google or one of the other options available. When you have finished creating your account, you will find that scanning the cluster is a very simple process. Installing Kubescape on your infrastructure is all that is required, after which you will need to submit your scans to the platform.

Kubescape will run the scan and the cloud platform will help you visualize the results in a GUI. The installation process of Kubescape CLI can be initiated by running the following command.

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

Once these installations are complete, we will have the correct posture to detect controls that have been placed so that we can implement Zero Trust on our infrastructure. Now, we will be able to conduct an accurate scan of the entire infrastructure. After logging in to your account, go to infrastructure, and then select 'Scan' from the drop-down menu, as shown in the screenshot below.


As soon as you click it, it will provide you with two different scanning alternatives. The second choice, in which Kubescape is installed on the infrastructure, is the one I go with.


Launch the terminal application on the computer in which Kubescape was installed and type in the following command.

kubescape scan --submit --account=<account-id-here>

Once this is done, Kubescape will start scanning the whole infrastructure.

It will create a map of the organization's whole posture, including all of its deployed components.


Because we used the submit flag (--submit) along with the command, everything will be submitted to Kubescape Cloud, and we will be able to easily search for each and every thing there.

Simply clicking on the link will allow you to visualize the RBAC.


You can easily filter different permissions using one of the many filters that are available, such as "who can delete," "who can list," or "who can watch". As a result, you can easily filter your results, which will assist you in applying the appropriate authentication and authorization to a variety of permissions. This directly corresponds to the most important rule of Zero Trust: "Never Trust Always Verify."


You can apply the Zero Trust policy on the Kubernetes cluster by simply checking the settings on each component individually; ensuring things like whether the appropriate authorization has been set for the whole infrastructure, privileged containers are terminated, and actions that do not meet the criteria of the organization are dealt with appropriatelu. You may even scan your Kubernetes-deployed infrastructure to see whether or not it is compatible with various alternative frameworks.

There are a variety of choices when it comes to various frameworks. You even have the ability to tailor your very own framework, which can be set as the rules of Zero Trust.


To scan using any of the frameworks, you just have to click on the frameworks tab and check the framework whose compatibility you are looking and it's done. It will show you all the controls that have been passed or failed for that particular framework.



You can even export the files showing the tests that have been passed or failed so it will be easy for the developer to apply those controls.

These are just some of the many helpful functions that are included in Kubescape. It is truly a comprehensive answer to all your frameworks and Zero Trust concerns.

Conclusion
----------

The Zero Trust architecture is now a need for most businesses dealing with confidential data and having teams across multiple locations. But, it is not simple to implement Zero Trust without having an accurate picture of the Kubernetes architecture that has been deployed. When you have achieved the correct posture of the architecture, meaning that you have control, privileges, and a container full of other information, you will be able to enforce the Zero Trust structure on those components. As a result, having access to the appropriate software is necessary for having an adequate grasp of architecture.