Chapter 10 — Cloud and container security: orientation | Technologist Cloud and container security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 The field"]
  N2["10.2 Cobalt's problem"]
  N3["10.3 Main areas"]
  N4["10.4 Kubernetes security docs"]
  N5["10.5 Plan"]
  N6["10.6 Agreement"]
  N7["Learning resources"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 The field"]
  N2["10.2 Cobalt's problem"]
  N3["10.3 Main areas"]
  N4["10.4 Kubernetes security docs"]
  N5["10.5 Plan"]
  N6["10.6 Agreement"]
  N7["Learning resources"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 The field]
    |
    v
[10.2 Cobalt's problem]
    |
    v
[10.3 Main areas]
    |
    v
[10.4 Kubernetes security docs]
    |
    v
[10.5 Plan]
    |
    v
[10.6 Agreement]
    |
    v
[Learning resources]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) map the cloud and container security field; (2) locate Cobalt's problem within it; (3) plan the rest of the course.

10.1 The field

Cloud and container security covers configuring cloud services, building and running images, managing identities, protecting data and monitoring. Standards include NIST SP 800-190 for containers, CSA CCM v4 for cloud controls and the CIS Benchmarks for configuration. The field also overlaps with neighbouring work: application security covers the code inside the images, and identity management covers the accounts that reach the clusters. Priya keeps her placement focused on the hosting layer that Cobalt controls, noting where other areas begin. The shared responsibility pages from AWS, Azure and Google Cloud help her draw that line for each client.

10.2 Cobalt's problem

The six-hour search showed that Cobalt lacked an inventory of images. Without it, advisories, audits and incidents all start slowly. The same gap would slow other kinds of security work too. An auditor asking which clients run unapproved images, or an incident responder asking where a compromised image is deployed, would face the same manual search. Fixing the inventory therefore helps more than one future question, which is why Priya's plan starts there before any other area. Priya records the six hours as the starting value for every later comparison.

10.3 Main areas

Priya groups the work into inventory, configuration baselines, identity, data flows, pipeline checks and monitoring. Each area answers a different question: inventory says what runs, configuration baselines say whether clusters are set up safely, identity says who can act, data flows say where information goes, pipeline checks stop risky changes, and monitoring shows what happened. Priya orders them so each builds on the one before, starting with inventory because every later area needs to know what exists. Data flows come second, since mapping them depends on first knowing which workloads exist.

10.4 Kubernetes security docs

The Kubernetes project documents Pod Security Standards, RBAC, network policies and good practices for secrets. These are free and written for operators. Priya uses these pages as primary references rather than relying on blog summaries, because they describe current behaviour and note when features change. The Pod Security Standards page, for example, defines exactly what Restricted requires, which she needs when warn mode later reports violations. She records the page date when she reads each one, since Kubernetes documentation changes with releases.

10.5 Plan

Over the next chapters Priya will build an inventory, check data flows, apply a baseline, review logs, add pipeline checks and evaluate the result. The order of the plan is deliberate rather than convenient. The inventory comes first because baselines, flows and evaluation all need to know what runs; monitoring comes after audit logs are enabled; pipeline checks follow once the baseline defines what to block. Evaluation then reuses the measures defined earlier, and the handoff makes sure the work continues after the placement ends. Each step names its deliverable, so Kwame can check progress against the plan every week.

10.6 Agreement

Kwame and Northgate agree on her placement objectives and confirm she works only on synthetic copies or with supervision. The agreement lists her objectives as the deliverables in her one-page plan, names Kwame as supervisor and states that any access to client systems is read-only and supervised. Northgate's placement tutor keeps a copy, so assessment later checks Priya's work against the same objectives. The agreement also confirms that she will not test client systems for weaknesses. Any later change to the objectives needs agreement from both Kwame and the Northgate tutor.

Learning resources

Priya builds a reading list: the NIST definitions in SP 800-145, the container guidance in SP 800-190, the CSA CCM v4 control list, the CIS Kubernetes Benchmark and the Kubernetes security documentation. For each she notes which chapters of her placement it supports, so she reads with a purpose rather than trying to absorb everything at once. Kwame adds the shared responsibility pages from the three main providers, because Cobalt's clients use different providers.

Boundaries of the placement

Priya does not test client systems for weaknesses.

Worked example

Priya writes a one-page plan linking each area to a deliverable: inventory script, flow list, baseline check, log summary, pipeline rule set, evaluation and handoff pack. Kwame approves it.

Synthetic case. Plan is synthetic.

Errors and limits

Trying to cover every area at once spreads effort too thin.

Exercises

EX028 — Field sources. Name three sources for cloud and container security guidance.
Show marking criteria
Rubric: 3 = SP 800-190, CCM v4, CIS, Kubernetes docs; 2 = two; 1 = one; 0 = none.
EX029 — Root gap. What gap did the six-hour search reveal?
Show marking criteria
Rubric: 3 = no image inventory; 2 = partial; 1 = vague; 0 = none.
EX030 — Deliverables. List Priya's planned deliverables.
Show marking criteria
Rubric: 3 = inventory, flows, baseline, logs, pipeline, evaluation, handoff; 2 = five; 1 = three; 0 = none.

Synthesis

Locate a concrete problem in the field before choosing tools.

Continue studying — chapter 10 of 30

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →