一句话：通过 CIS 推荐配置、开发者调查、544 个配置文件和 5 个 SAST 工具，揭示 Kubernetes 安全配置推荐与实践的脱节。
Kubernetes 虽有利于快速交付软件，但其部署易受安全攻击。本文系统研究安全专家推荐（如 CIS 规范）的社区安全配置在实践中的落地情况。作者分析了 CIS 的 53 条安全配置，调查 20 名受访者，并收集开源与专有领域的 544 个配置文件。结果显示，5%～40% 的受访者对 16 条推荐配置不熟悉；Company-A 和 OSS 中分别有 18.0% 和 17.9% 的配置文件至少违反一条推荐配置。进一步用 5 个 SAST 工具评估发现，仅 Kubescape 覆盖全部推荐配置类别，最高 precision 分别为 0.41 和 0.43，最高 recall 分别为 0.53 和 0.65。研究揭示 CIS 专家推荐与 Kubernetes 实践之间的脱节，并给出对从业者和研究者的建议，数据集公开。
Despite being beneficial for rapid delivery of software, Kubernetes deployments can be susceptible to security attacks, which can cause serious consequences. A systematic characterization of how community-prescribed security configurations, i.e., security configurations that are recommended by security experts, can aid practitioners to secure their Kubernetes deployments. To that end, we conduct an empirical study with 53 security configurations recommended by the Center for Internet Security (CIS), 20 survey respondents, and 544 configuration files obtained from the open source software (OSS) and proprietary domains. From our empirical study, we observe: (i) practitioners can be unaware of prescribed security configurations as$5 \% \sim 40 {\%}$of the survey respondents are unfamiliar with 16 prescribed configurations; and (ii) for Company-A and OSS respectively, 18.0% and 17.9% of the configuration files include at least one violation of prescribed configurations. From our evaluation with 5 static application security testing (SAST) tools we find (i) only Kubescape to support all of the prescribed security configuration categories; (ii) the highest observed precision to be 0.41 and 0.43 respectively, for the Company-A and OSS datasets; and (iii) the highest observed recall to be respectively, 0.53 and 0.65 for the Company-A and OSS datasets. Our findings show a disconnect between what CIS experts recommend for Kubernetes-related configurations and what happens in practice. We conclude the paper by providing recommendations for practitioners and researchers. Dataset used for the paper is publicly available online.
DOI 原文 ·
@inproceedings{paperbot8907,
title = {On Prescription or Off Prescription? An Empirical Study of Community-Prescribed Security Configurations for Kubernetes},
author = {Shazibul Islam Shamim and Hanyang Hu and Akond Rahman},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00170}
}