Pular para o conteúdo
Techstream

Vol. III

Cloud-Native Security for DevSecOps

Zero trust, Kubernetes hardening, IaC security and compliance automation

Vol. III

§ 01, Do que trata

Zero-trust architecture, Kubernetes hardening, infrastructure-as-code security and compliance automation, with evidence mapped to ISO 27001, SOC 2, PCI DSS and DORA. The compliance part is the Compliance Automation Framework explained at length.

§ 02, O que quero que o leitor consiga fazer

  1. 01

    Harden a Kubernetes cluster and show which control covers which risk.

  2. 02

    Keep infrastructure code scanned, policy-checked and free of secrets.

  3. 03

    Map a control to ISO 27001, SOC 2, PCI DSS or DORA and collect its evidence from the pipeline.

§ 03, O diagrama ao qual eu sempre volto

Rola para o lado →

Cloud-native securityKubernetes clusterprod namespacepodapp:v2podsidecarpodenvoyOPA Gatekeeperadmission policyFalcoruntime alertsstaging namespacepodtest-apppodmock-svcNetworkPolicyingress / egress rulesmTLSService mesh (Istio / Linkerd)mTLS between pods · SPIFFE identityRBAC + Pod Security Admissionleast-privilege rolesExternal Secrets Operator → Vaultsecrets never in etcd plaintext
Figure, Volume III: a hardened cluster, with admission policy, runtime detection, network policy, a service mesh and secrets kept out of etcd.

§ 04, Estrutura planejada

  1. Parte I

    Zero trust architecture

    Workload identity, mutual TLS and just-in-time access, applied to cloud-native systems.

  2. Parte II

    Kubernetes security engineering

    Hardened images, pod security standards, admission policy, runtime detection and network policy.

  3. Parte III

    Infrastructure as code security

    Scanning and policy for infrastructure code, secrets kept out of it, and drift caught before it matters.

  4. Parte IV

    Compliance automation

    A continuous compliance pipeline, with controls mapped to ISO 27001, SOC 2, PCI DSS and DORA and evidence collected as a side effect.

§ 05, Quando der para ler

Este volume está sendo escrito. Deixe seu e-mail e eu mando uma única mensagem quando der para ler.

Um e-mail quando der para ler.

← Os seis volumes