Aller au contenu
Techstream

Vol. III

Cloud-Native Security for DevSecOps

Zero trust, Kubernetes hardening, IaC security and compliance automation

Vol. III

§ 01, De quoi il s'agit

Zero-trust architecture, Kubernetes hardening, infrastructure-as-code security and compliance automation, with evidence mapped to ISO 27001, SOC 2, PCI DSS and DORA. The compliance part is the Compliance Automation Framework explained at length.

§ 02, Ce que je veux que le lecteur sache faire

  1. 01

    Harden a Kubernetes cluster and show which control covers which risk.

  2. 02

    Keep infrastructure code scanned, policy-checked and free of secrets.

  3. 03

    Map a control to ISO 27001, SOC 2, PCI DSS or DORA and collect its evidence from the pipeline.

§ 03, Le schéma auquel je reviens toujours

Défile sur le côté →

Cloud-native securityKubernetes clusterprod namespacepodapp:v2podsidecarpodenvoyOPA Gatekeeperadmission policyFalcoruntime alertsstaging namespacepodtest-apppodmock-svcNetworkPolicyingress / egress rulesmTLSService mesh (Istio / Linkerd)mTLS between pods · SPIFFE identityRBAC + Pod Security Admissionleast-privilege rolesExternal Secrets Operator → Vaultsecrets never in etcd plaintext
Figure, Volume III: a hardened cluster, with admission policy, runtime detection, network policy, a service mesh and secrets kept out of etcd.

§ 04, Structure prévue

  1. Partie I

    Zero trust architecture

    Workload identity, mutual TLS and just-in-time access, applied to cloud-native systems.

  2. Partie II

    Kubernetes security engineering

    Hardened images, pod security standards, admission policy, runtime detection and network policy.

  3. Partie III

    Infrastructure as code security

    Scanning and policy for infrastructure code, secrets kept out of it, and drift caught before it matters.

  4. Partie IV

    Compliance automation

    A continuous compliance pipeline, with controls mapped to ISO 27001, SOC 2, PCI DSS and DORA and evidence collected as a side effect.

§ 05, Quand ce sera lisible

Ce volume est en cours d’écriture. Laissez votre e-mail et je vous enverrai un seul message quand il sera lisible.

Un seul e-mail quand ce sera lisible.

← Les six volumes