No abstract

No abstract

Kubernetes emerged as docker containers' most popular orchestration, it is widely used for developing microservices and deploying applications. Because of advancements in containerization technology, information technology organizations use Kubernetes to manage their systems and report benefits in the deployment process. However, security concerns have been highlighted as challenges in Kubernetes deployment, The hackers can exploit the security vulnerabilities to cause damage to company assets. This work will shed the light on the Kubernetes orchestration platform and how attacks can be contacted against subevents manifest. we also demonstrate 10 security best practices in the Kubernetes cluster based on practitioners' reports, which we should follow to help protect our infrastructure.

The work focuses on software-defined network security, as it was always one of these foremost critical concerns due to the centralized nature in SDN architecture where many serious attacks in traditional networks still appear in SDN networks such as ARP spoofing attack despite many existing security algorithms, methods and systems. In this work, we proposed a new approach to secure SDN from an ARP poisoning attack. The new solution extends the controller with a new module that uses a new algorithm to detect and mitigate the ARP spoofing attacks according to three states of each host in the network. The new mechanism involves the DHCP and manual assignment of IP addresses using three classes to classify the hosts according to their situations in the network. The CHT helps to set the host in an intermediate state between verifying and banning and detect the attack according to the next step of the host. The proposed mechanism was tested successfully in a simulated environment using Mininet and POX controller. The solution was effectively able to accomplish the objective for which it was built, with a limited overhead on the network. This proposed solution neither has an extra overload in the network, nor requires any changes in the infrastructure or additional hardware to install. According to the experiment results of this solution, the average time to detect the ARP spoofing attack is about 11 ms, with minor overhead on the controller CPU.