Cloud Native Security 101: Building Blocks, Patterns and Best Practices
summary
Explains concrete controls: maps five lifecycle phases (code build provision deploy run) to checkpoints, advocates image signing plus admission controllers (Gatekeeper) and registry + CI scanners, and pushes runtime vulnerability prioritization by “in use” detection so only the one CVE active in memory gets urgent fixes. Recommends Falco/Sysdig for runtime detection, daemonset-based host scanning, minimal base images (example: critical CVEs drop from 15 to 1 by using slim images), and continuous CSPM drift-and-remediation via IaC pull requests.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:28Anatomy of Cloud Native Application
- 3:26Cloud Native Acronym
- 6:30CNAPP Building Blocks
- 8:06Cloud Attack Vectors
- 9:34Kubernetes Attack Vectors
- 10:45Container Workload Attack Vectors
- 12:03Lifecycle of Cloud Native Application
- 13:17Secure Cloud Native Application
- 15:55Container In-Use vulnerabilities Prioritization
- 18:08Container Image Signing
- 19:49Gatekeeper pattern (AC)
- 21:26Base Image & Layer Analysis
- 23:21Continuous & Actionable Compliance
- 24:35Risk Assessment and Prioritization
- 25:27Cloud Security Personas
- 28:31DevSecOps (workload integrity)
- 29:25DevSecOps (Admission Controller)
- 30:27laC security (build phase)
- 32:25Takeaways
related talks
37mCloud Native Security 101 - Introduction, Workflows and Best practices
34mCloud Native Security: A New Paradigm for a New World
40mCloud Native Security: A New Paradigm for a New World
35mCloud Native Security for the Rest of Us
23mCloud Native Security for the Rest of Us
41mCloud Native Security For The Rest Of Us
52mSecurity in Cloud-Native
41mPanel: Securing Cloud Native Applications