Cloud Native Security For The Rest Of Us
summary
Maps cloud native security into concrete actions: use managed Kubernetes to offload control plane hardening, enforce TLS certs (no --insecure-skip-tls-verify), apply Pod Security Standards and NetworkPolicies, block metadata server access, and keep clusters within a year of supported API changes. Isolate compute with quotas, taints, and sandbox runtimes like gVisor/Kata/Firecracker. Protect secrets with KMS/Vault, SealedSecrets or Sops and enable encryption at rest. Harden the software supply chain with Sigstore + in-toto, reproducible builds, Trivy/Clair scans, Gatekeeper policies and Velero backups.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:58FOLLOW SECURITY BEST PRACTICES
- 2:144 C's OF CLOUD NATIVE SECURITY
- 4:31SECURING CONTROL PLANES & NODES CONT'D
- 6:00UPGRADING KUBERNETES
- 7:23Mini Case Study: Ingress
- 8:59ISOLATING COMPUTE
- 9:53ISOLATING NETWORK RESOURCES
- 14:26AUTHENTICATION (AUTHN)
- 19:02NAMESPACES vs CLUSTER WIDE
- 19:38GOTCHA: ADMIN PERMISSIONS
- 21:35SOFTWARE SUPPLY CHAIN
- 26:46SOME ACTUAL THREAT MODELS & HOW TO MITIGATE THEM
- 29:16ADDITIONAL COMPONENTS
- 32:08DON'T FORGET ABOUT YOUR CODE
related talks
23mCloud Native Security for the Rest of Us
35mCloud Native Security for the Rest of Us
34mCloud Native Security: A New Paradigm for a New World
34mCloud Native Security 101: Building Blocks, Patterns and Best Practices
37mCloud Native Security 101 - Introduction, Workflows and Best practices
24mOne stop talk for kubernetes security !!
40mCloud Native Security: A New Paradigm for a New World
46mContinuous Kubernetes Security