Maya Kaczorowski — Container and Orchestration Security

Containers can improve your security story, but not simply because they are called containers. Maya Kaczorowski, working on container security at Google at the time of this conversation, joins Chris and Robert to separate packaging and orchestration benefits from the isolation guarantees people often assume. She explains how smaller services, consistent environments, and faster updates can help, then considers what an attacker wants from a compromised workload or cluster. The discussion covers image provenance, malicious images, permissions, and alternatives that strengthen isolation, including gVisor and Kata Containers. Maya also describes a practical progression for teams adopting Kubernetes: learn the environment, understand the risks, and build security into deployment decisions rather than treating the first working cluster as a finished system.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Maya Kaczorowski:
→ LinkedIn
→ Maya's website

Mentioned in this episode:
→ Kubernetes
→ gVisor
→ Kata Containers
→ Kubernetes admission controllers
→ Exploring container security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:29 From mathematics to security product work
03:42 Moving into container security
06:58 Containers and orchestration explained
09:12 Docker, runtimes, and orchestration choices
10:33 How containers can improve security
14:18 Stronger isolation with sandboxed runtimes
15:33 Threat modeling an attacker in a container
18:03 Where your images come from
20:03 Typosquatting and malicious images
21:50 Defending workloads and clusters
26:26 The container security learning journey
31:15 Resources for learning more