Kubernetes is a powerful and complex platform, that can provide huge benefits as well as significant dilemmas to an organisation. Without a structured Kubernetes design, deployment and operation strategy, organisations may involuntarily introduce additional operational and security risks which become more challenging to address as the infrastructure scales up (or out).

This talk presents a risk-aware and risk-driven technical approach based on threat modelling (of infrastructure, people, and supply chains) to derive security requirements, technical controls and countermeasures, both native to Kubernetes (including release 1.25) and provided by open-source tools.

To validate this approach, the presentation also reveals real-world challenges that customers face to stay up to speed with the ever-evolving threat landscape in their Kubernetes journey.