Threat Modeling for Kubernetes - Enhancing Security Posture in Complex and Regulated Environments

Learn a practical, non-traditional threat modeling approach specifically designed for Kubernetes environments in this 31-minute conference talk from OpenSSF. Discover how to navigate the complexity of Kubernetes deployments, particularly in regulated industries like financial services, where third-party integrations such as mesh solutions, secrets management, and governance tools create additional security challenges. Explore techniques for identifying risks across clusters, workloads, and third-party components while understanding how to seamlessly integrate threat modeling into development and Site Reliability Engineering (SRE) workflows. Gain insights into leveraging large language models (LLMs) to accelerate threat identification processes, map security concerns to the MITRE ATT&CK framework, and support continuous security improvements. Walk away with concrete, actionable strategies to operationalize threat modeling practices and significantly strengthen your Kubernetes security posture in complex and regulated environments.