Chapter 9 — Cloud and container security: leadership and assurance
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Leadership"]
N2["9.2 Assurance"]
N3["Lab — quarterly assurance"]
N4["9.3 Lab result"]
N5["9.4 Independent check"]
N6["9.5 Board report"]
N7["9.6 Sustaining"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Leadership"]
N2["9.2 Assurance"]
N3["Lab — quarterly assurance"]
N4["9.3 Lab result"]
N5["9.4 Independent check"]
N6["9.5 Board report"]
N7["9.6 Sustaining"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Leadership]
|
v
[9.2 Assurance]
|
v
[Lab — quarterly assurance]
|
v
[9.3 Lab result]
|
v
[9.4 Independent check]
|
v
[9.5 Board report]
|
v
[9.6 Sustaining]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) lead the programme across teams; (2) provide assurance with measured evidence; (3) track improvement; (4) report to the board.
9.1 Leadership
Inês chairs a fortnightly working group with platform and product leads, keeping a visible plan and celebrating milestones. A fortnightly group keeps the platform and product leads talking, so problems such as a team resisting enforcement are raised early. The visible plan shows which clusters have moved through audit, warn and enforce, and celebrating milestones, such as the first cluster fully enforced, keeps momentum during a long rollout. When one product lead resisted tests in Q2, the group helped Inês find a compromise.
9.2 Assurance
Each quarter the security team runs behaviour tests on 15 sample namespaces, measures exception age and counts exceptions. Behaviour tests show whether admission actually rejects unsafe workloads, not just whether labels are set. Sampling 15 namespaces each quarter keeps the work manageable while covering every cluster. Exception age and count show whether exceptions are being cleared. Inês designs the tests to run in staging mirrors where possible, with one production check, after a product lead raised concerns about disruption. Results go to the working group and the risk committee.
Lab — quarterly assurance
"""Quarterly assurance indicators for the cloud estate (synthetic, stdlib only)."""
q = {"Q1": (6, 15, 61, 21), "Q2": (11, 15, 38, 9), "Q3": (15, 15, 12, 4)}
# (namespaces enforced... out of 15, total namespaces, median days risky config live, open exceptions)
for k, (e, t, days, ex) in q.items():
print(f"{k}: enforced {e}/{t} ({100*e/t:.0f}%), median days risky config live {days}, open exceptions {ex}")
Run with python3 lab_assurance.py. Verified output:
Q1: enforced 6/15 (40%), median days risky config live 61, open exceptions 21
Q2: enforced 11/15 (73%), median days risky config live 38, open exceptions 9
Q3: enforced 15/15 (100%), median days risky config live 12, open exceptions 4
9.3 Lab result
Q1: 6/15 namespaces pass (40%), mean exception age 61 days, 21 exceptions. Q2: 11/15 (73%), 38 days, 9. Q3: 15/15 (100%), 12 days, 4. Improvement is steady; the sample is small, so the board report gives counts and notes the sampling method. The improvement follows the rollout: as clusters moved to enforce, more sampled namespaces passed, and exceptions fell as teams fixed workloads. Inês reports how the 15 namespaces were sampled beside each quarter's figure. With 15 namespaces per quarter, one failing namespace changes the pass rate by about seven points, so Inês reports counts alongside each percentage and warns the board against reading small changes as trends. The Q3 result is checked independently by internal audit before it is presented as final.
9.4 Independent check
Internal audit repeats the Q3 tests on a different sample and finds the same result. Using a different sample tests whether the security team's result depended on which namespaces it chose. Internal audit works independently of the platform and security teams, so its result adds confidence for the board and regulator. Internal audit's report is filed with the security team's Q3 records, so both samples sit together. Inês notes that agreement on one quarter does not guarantee future results, which is why assurance continues. Internal audit's report names the namespaces it tested, so the two samples can be compared.
9.5 Board report
A one-page summary: what happened, what changed, measured results, remaining exceptions. The board needs to know whether the audit finding is closed and what risk remains, not technical detail. Inês keeps the summary to one page, reports the assurance figures as counts with the sample size, and lists remaining exceptions with their owners and expiry dates. The report is reviewed by Beacon's risk officer before it goes to the board. Prof. Rao reviews the draft as an example of reporting for a non-technical audience, and Inês shortens the technical terms after her comments.
9.6 Sustaining
Assurance continues quarterly; results feed the risk register. Quarterly assurance keeps checking that controls still work after changes such as cluster upgrades, which caused the original gap. Results feed the risk register, so a falling pass rate raises the risk rating and draws the committee's attention. The security team owns the tests, and their schedule is written into the control record. Inês hands the test scripts and method to the security team at the end of the project. The first post-project quarter is tested by the security team alone.
Reading the trend carefully
Prof. Rao asks whether the improvement could be explained by easier samples in later quarters. Inês shows that the sample was drawn the same way each quarter from the full namespace list, stratified by cluster, and that the namespaces with known exceptions were always eligible. She also notes that the number of namespaces grew during the year, so the later quarters cover a larger estate. These checks do not prove the trend, but they rule out the most obvious alternative explanation, and the board report says so in one sentence.
She also separates measures of activity from measures of outcome. Counting meetings held or rules written shows effort; pass rates and exception age show whether the estate is actually safer.
Worked example
In Q2 one product lead resists, saying tests disrupt deployments. Inês moves tests to staging mirrors except for one production check, and the lead agrees.
Synthetic case. Figures are synthetic.
Errors and limits
Small samples limit claims; say so.
Exercises
- EX041 — Lab trend. Give pass rates for Q1 to Q3. Rubric: 3 = 40%, 73%, 100%; 2 = two; 1 = one; 0 = none.
- EX042 — Exceptions trend. How did exceptions change? Rubric: 3 = 21 to 9 to 4; age 61 to 12; 2 = partial; 1 = vague; 0 = none.
- EX043 — Sample caution. Why note the sampling method? Rubric: 3 = small sample of 15; 2 = partial; 1 = vague; 0 = none.
- EX044 — Independent check. What did internal audit do? Rubric: 3 = repeated tests on different sample; 2 = partial; 1 = vague; 0 = none.
- EX045 — Resistance. How was the product lead's concern resolved? Rubric: 3 = tests on staging mirrors plus one prod check; 2 = partial; 1 = vague; 0 = none.
Synthesis
Lead with visible plans and assure with measured evidence.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →