Domain 1: Cluster Setup [10%]
- Kubernetes Network Policies
- Kubernetes CIS benchmark
- Ingress Security.
- Kubernetes Node Metadata & Endpoints.
- Securing Kubernetes GUI
- Verify platform binaries before deploying
Domain 2: Cluster Hardening [15%]
- Restrict access to Kubernetes API
- Use Role-Based Access Controls to minimize exposure
- Exercise caution in using service accounts e.g., disable defaults, minimize permissions on newly created ones.
- Update Kubernetes frequently.
Domain 3: System Hardening [15%]
- Minimize host OS footprint (reduce attack surface)
- Minimize IAM roles.
- Minimize external access to the network.
- Appropriately use kernel hardening tools such as AppArmor, seccomp.
Domain 4: Minimize Microservice Vulnerabilities [20%]
- Setup appropriate OS-level security domains e.g. using PSP, OPA, security contexts.
- Manage Kubernetes secrets.
- Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers).
- Implement pod to pod encryption by use of mTLS.
Domain 5: Supply Chain Security [20%]
- Minimize base image footprint.
- Secure your supply chain: whitelist allowed registries, sign and validate images.
- Use static analysis of user workloads (e.g.Kubernetes resources, Docker files).
- Scan images for known vulnerabilities.
Domain 6: Monitoring, Logging and Runtime Security [20%]
- Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities.
- Detect threats within a physical infrastructure, apps, networks, data, users, and workloads.
- Detect all phases of attack regardless of where it occurs and how it spreads.
- Perform deep analytical investigation and identification of bad actors within the environment.
- Ensure immutability of containers at runtime.
- Use Audit Logs to monitor access.
Why Cloud Technology Experts?
Our training is like on-the-job training. We don't just teach isolated topics, we make the student understand why what they are learning is important. We show you the bigger picture
