Cloud Native Security
Cloud native security protects containerized applications and their orchestration infrastructure. It addresses image supply chain integrity, runtime isolation, network segmentation, secrets management, and policy enforcement across dynamic, ephemeral workloads.
itCloud native tools and technologies | OpenSkills.info
Intro
Cloud Native Security
Cloud native systems change often. Workloads start and stop. Releases move through automated pipelines. Services communicate across networks that you do not fully control. A security model based only on a fixed network edge cannot follow that movement.
Cloud native security puts controls close to the workload and throughout its lifecycle. It protects the environment that builds software, the artifacts that carry it, the platform that deploys it, and the system that runs it. The goal is not a product stack. The goal is a chain of justified trust from source code to production behavior.
Use one mental model for the course: protect every stage, then verify the handoffs.
The four lifecycle stages
The CNCF model divides the application lifecycle into four continuous stages: develop, distribute, deploy, and runtime. A weakness at one stage can invalidate work done elsewhere.
Develop
The develop stage covers source code, dependencies, developer access, and the build definition. Start with a threat model. Identify valuable assets, trust boundaries, likely threats, and owners. Use code review, secure coding practices, dependency controls, and automated tests to shorten feedback.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://tag-security.cncf.io/community/resources/security-whitepaper/v2/cloud-native-security-whitepaper/
Supports
- Cloud native security across develop, distribute, deploy, and runtime stages
- Cloud native layers and the dependence between lifecycle controls and runtime foundations
- Security automation close to dynamic workloads and throughout delivery
- Cross-functional ownership among development, operations, and security roles
- https://kubernetes.io/docs/concepts/security/cloud-native-security/
Supports
- Develop, distribute, deploy, and runtime control examples
- Runtime protection across access, compute, storage, networking, and observability
- Deployment restrictions, artifact verification, workload privilege, and isolation choices
- Detection, trustworthy telemetry, and infrastructure protections below orchestration
- https://kubernetes.io/docs/concepts/security/security-checklist/
Supports
- Baseline review areas for authentication, authorization, network policy, pod security, secrets, images, and audit
- Checklists as a starting point rather than sufficient proof of security
- https://csrc.nist.gov/pubs/sp/800/190/final
Supports
- Containers as operating-system virtualization combined with application packaging
- Container risk areas across images, registries, orchestrators, containers, and hosts
- Recommendations for image, registry, orchestrator, runtime, and host security
- The shared host operating-system kernel as part of the container security boundary
- https://slsa.dev/spec/v1.2/
Supports
- SLSA version 1.2 tracks, levels, requirements, and attestation formats
- Increasing supply-chain guarantees and artifact provenance
- Producer and consumer uses of verifiable supply-chain evidence
- https://slsa.dev/spec/v1.2/about
Supports
- SLSA limits regarding code quality, malicious producers, and transitive dependency trust
- Tradeoffs between stronger guarantees and implementation cost
- https://spiffe.io/docs/latest/spiffe-about/overview/
Supports
- Workload identity for dynamic and heterogeneous environments
- Short-lived cryptographic identity documents and automatic rotation
- Limits of static network identifiers for workload authentication