Biography:I began my career as a Java developer and progressively advanced through roles like Software Engineer, Senior Software Engineer, and ultimately Technical Lead, accumulating over eight years of industry experience in the supply chain and e commerce domain. I have also worked in the hospitality domain during the initial days of my career. Lately before quitting my job, my work centered around microservices architecture based, Kubernetes hosted customer service applications, giving me good hands-on familiarity with the very infrastructure of the KARECTL project.
Alongside my development and issue support responsibilities, I worked closely with my organisation’s application security team, where I developed a strong interest in security and embedding it into software development. I worked in maintaining the security posture of our platform through SAST and DAST tools such as SonarQube and Burp Suite, performing security checks and ensuring OWASP Top 10 vulnerabilities were identified and mitigated across our codebase. This experience revealed that the delivery speed of software products can sometimes come at a cost to security, leaving authentication weaknesses and poor access controls to be patched after release. Thus, I became interested in bridging the gap between software development and security and building secure resilient systems from the start of the software development lifecycle itself.
This led me to the decision to pursue an MSc in Cybersecurity at Lancaster University so that I can deepen my understanding of cybersecurity at an academic level. In my spare time, I enjoy exploring intentionally vulnerable demo microservices applications such as the Weaveworks Sock Shop, reverse engineering their security failures layer by layer and drafting controls to address them. The KARECTL project is a natural alignment for me
because it combines Kubernetes based microservices, healthcare research infrastructure, and practical security challenges in a meaningful real world environment.
Project Summary:This project addresses a critical network security gap in KARECTL, the Kubernetes based Trusted Research Environment developed at Lancashire Teaching Hospitals NHS Foundation Trust. By default, Kubernetes permits unrestricted pod to pod communication across the cluster, which presents a significant security risk when handling sensitive NHS patient data, where a single compromised container could enable lateral movement and potential data exposure.
The project investigates, designs, implements, and evaluates a layered Kubernetes security architecture using Cilium, an eBPF based identity driven network security platform, together with Kyverno, a Kubernetes native policy engine for workload governance and admission control. Together, these technologies aim to strengthen network isolation, workload security, and policy enforcement across the platform.
The work will be evaluated through controlled attack simulations covering lateral movement, privilege escalation, identity spoofing, and data exfiltration, alongside observability analysis, quantitative performance benchmarking, and compliance mapping against the SATRE specification for Trusted Research Environments. Expected outputs include reusable security policy catalogues and practical recommendations to help strengthen governance and security within the KARECTL platform.