Secure By Design: Architecting cloud and AI workloads from the perspective of infosec
summary
Covers concrete controls to harden cloud and AI runtimes: enable secure boot and shielded VMs on node pools, make control planes private, use workload identity instead of mounted keys, and deploy policy controller/gatekeeper and image signing (cosign or Binary Authorization) so deployments match tested hashes. Calls out that ~50% of production Kubernetes clusters run insecure software and 46% of breaches cause revenue/customer loss. Recommends perimeters with VPC Service Controls, PSC for managed databases, and row/column tagging for BigQuery.
AI-written summary · about
chapters (8)
- 0:00Platform security focus
- 1:59Securing Kubernetes clusters
- 9:49Supply chain security
- 14:07Securing serverless services
- 16:15Data security in PostgreSQL and BigQuery
- 23:19Global security controls
- 34:58Layered cloud security approach
- 35:42Q&A
related talks
22mSecuring Kubernetes
46mAvoiding Common Design and Security Mistakes in Cloud AI/ML Environment
53mFlying Above the Clouds: Securing Kubernetes
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security
35mCloud Native Security for the Rest of Us
21mDefense-in-Depth Security for Mission-Critical Service
01h 17mSecure by Design - Security Principles for the Working Architect
10mKeynote: CloudNativeDevSecOps