Security Incident

An overly permissive RBAC configuration allowed an attacker to:

1. Gain access through a compromised developer account
2. Escalate privileges using cluster-admin binding
3. Deploy cryptocurrency mining containers
4. Access sensitive data from other namespaces

How It Happened

• Default namespace had cluster-admin role binding
• No network policies between namespaces
• No pod security policies enforced
• Developer accounts had excessive permissions

Immediate Actions

1. Revoked all compromised credentials
2. Deleted malicious pods
3. Isolated affected nodes
4. Rotated all cluster certificates

Long-term Fixes

• Implemented principle of least privilege
• Enabled network policies
• Deployed pod security admission
• Regular RBAC audits
• Developer security training