Introduction
Overview of Cloud Native Security
- The Attack
- The 4Cs of Cloud Native Security
- Cloud Provider Security
- Infrastructure Security
- Kubernetes Isolation Techniques
- Artifact Repository and Image Security
- Application Code Security
Kubernetes Cluster Component Security
- API Server
- Securing Controller Manager Scheduler
- Securing the Kubelet
- Securing Container Runtime
- Securing Kube Proxy
- Pod Security
- Securing Etcd
- Securing Container Networking
- Kubectl Proxy Port Forward
- Client Security kubeconfig
- Securing Storage
Kubernetes Security Fundamentals
- Pod Security Standards Pod Security Admissions
- Authentication
- Authorization
- Role Based Access Controls
- Solution RBAC
- Secrets
- Kubernetes Namespaces
- Solution Namespace
- Resource Requirements
- Lab Solution Resource Limits
- Security Contexts
- Solution Security Context
- Kubernets Auditing
- Network Policies
Kubernetes Threat Model
- Kubernetes Trust Boundaries and Data Flow
- Persistence
- Denial of Service
- Malicious Code Execution
- Compromised Applications in Containers
- Attacker on the Network
- Access to Sensitive Data
- Privilege Escalation
Platform Security
- Minimize base image footprint
- Scan images for known vulnerabilities Trivy
- Image Security
- Perform behavioral analytics of syscall process
- Falco Overview and Installation
- Use Falco to Detect Threats
- Service Mesh Monolithics vs Microservices
- Service Mesh
- Service Mesh Istio
- Service Mesh Security in Istio
- Service Mesh Istio Security Architecture
- TLS in Kubernetes Certificate Creation
- View Certificate Details
- TLS Introduction
- TLS Basics
- TLS in Kubernetes
- One way SSL vs Mutual SSL
- Admission Controllers