Information Technology

Certified Kubernetes Security Specialist (CKS)

Instructor-Led 19 Agenda

What You'll Learn

In this course, students will learn and practice essential Kubernetes concepts and tasks in the following sections: Cloud Security Fundamentals Cluster Hardening System Hardening Minimize Microservice Vulnerabilities Supply Chain Security Disaster Recovery Secure Back-up and Restore

Description

This class prepares students for the Certified Kubernetes Security Specialist (CKS) exam. Kubernetes is a Cloud Orchestration Platform providing reliability, replication, and stability while maximizing resource utilization for applications and services. By the conclusion of this hands-on, vendor agnostic training you will be equipped with a thorough understanding of cloud security fundamentals, along with the knowledge, skills and abilities to secure a Kubernetes cluster, detect threats, and properly resolve a security catastrophe. This course includes hands-on instruction which develops skills and knowledge for securing container-based applications and Kubernetes platforms, during build, deployment, and runtime. We prioritize covering all objectives and concepts necessary for passing

Who Should Attend

Security Professionals working with Kubernetes Clusters Container Orchestration Engineers DevOps Professionals

Course Overview

Course Agenda

19 Title

Course Agenda 19

Lesson Id	Title	Description
1	Learning Your Environment	Underlying Infrastructure<br />Using Vim<br />Tmux
2	Cloud Security Primer	Basic Principles<br />Threat Analysis<br />Approach<br />CIS Benchmarks
3	Securing your Kubernetes Cluster	Kubernetes Architecture<br />Pods and the Control Plane<br />Kubernetes Security Concepts
4	Install Kubernetes using kubeadm	Configure Network Plugin Requirements<br />Kubeadm Basic Cluster<br />Installing Kubeadm<br />Join Node to Cluster<br />Kubeadm Token<br />Manage Kubeadm Tokens<br />Kubeadm Cluster Upgrade
5	Securing the kube-apiserver	Configuring the kube-apiserver<br />Enable Audit Logging<br />Falco<br />Deploy Falco to Monitor System Calls<br />Enable Pod Security Policies<br />Encrypt Data at Rest<br />Encryption Configuration<br />Benchmark Cluster with Kube-Bench<br />Kube-Bench
6	Securing ETCD	ETCD Isolation<br />ETCD Disaster Recovery<br />ETCD Snapshot and Restore
7	Purge Kubernetes	Purge Kubeadm<br />3Purge Kubeadm
8	Image Scanning	Container Essentials<br />Secure Containers<br />Creating a Docker Image<br />Scanning with Trivy<br />Trivy<br />Snyk Security
9	Manually Installing Kubernetes	Kubernetes the Alta3 Way<br />Deploy Kubernetes the Alta3 Way<br />Validate your Kubernetes Installation<br />Sonobuoy K8s Validation Test
10	Kubectl (Optional)	Kubectl get and sorting<br />kubectl get<br />kubectl describe
11	Labels (Optional)	Labels<br />Labels and Selectors<br />Annotations<br />Insert an Annotation
12	Securing your Application	Scan a Running Container<br />Tracee<br />Security Contexts for Pods<br />Understanding Security Contexts<br />AppArmor Profiles<br />AppArmor<br />Isolate Container Kernels<br />gVisor
13	Pod Security	Pod Security Policies<br />Deploy a PSP<br />Pod Security Standards<br />Enable PSS
14	Open Policy Agent (OPA)	Admission Controller<br />Create a LimitRange<br />Open Policy Agent<br />Policy as Code<br />Deploy Gatekeeper
15	User Administration	Contexts<br />Contexts<br />Authentication and Authorization<br />Role Based Access Control<br />Role Based Access Control<br />RBAC Distributing Access<br />Service Accounts<br />Limit Pod Service Accounts
16	Securing Secrets	Secrets<br />Create and Consume Secrets<br />Hashicorp Vault<br />Deploy Vault
17	Securing the Network	Networking Plugins<br />NetworkPolicy<br />Deploy a NetworkPolicy<br />mTLS<br />Linkerd<br />mTLS with istio<br />istio
18	Threat Detection	Active Threat Analysis<br />Host Intrusion Detection<br />Deploy OSSEC<br />Network Intrusion Detection<br />Deploy Suricata<br />Physical Intrusion Detection
19	Disaster Recovery	Harsh Reality of Security<br />Deploy a Response Plan<br />Kasten K10 Backups<br />Deploy K10

Learning Your Environment

Underlying Infrastructure
Using Vim
Tmux

Cloud Security Primer

Basic Principles
Threat Analysis
Approach
CIS Benchmarks

Securing your Kubernetes Cluster

Kubernetes Architecture
Pods and the Control Plane
Kubernetes Security Concepts

Install Kubernetes using kubeadm

Configure Network Plugin Requirements
Kubeadm Basic Cluster
Installing Kubeadm
Join Node to Cluster
Kubeadm Token
Manage Kubeadm Tokens
Kubeadm Cluster Upgrade

Securing the kube-apiserver

Configuring the kube-apiserver
Enable Audit Logging
Falco
Deploy Falco to Monitor System Calls
Enable Pod Security Policies
Encrypt Data at Rest
Encryption Configuration
Benchmark Cluster with Kube-Bench
Kube-Bench

Securing ETCD

ETCD Isolation
ETCD Disaster Recovery
ETCD Snapshot and Restore

Purge Kubernetes

Purge Kubeadm
3Purge Kubeadm

Image Scanning

Container Essentials
Secure Containers
Creating a Docker Image
Scanning with Trivy
Trivy
Snyk Security

Manually Installing Kubernetes

Kubernetes the Alta3 Way
Deploy Kubernetes the Alta3 Way
Validate your Kubernetes Installation
Sonobuoy K8s Validation Test

Kubectl (Optional)

Kubectl get and sorting
kubectl get
kubectl describe

Labels (Optional)

Labels
Labels and Selectors
Annotations
Insert an Annotation

Securing your Application

Scan a Running Container
Tracee
Security Contexts for Pods
Understanding Security Contexts
AppArmor Profiles
AppArmor
Isolate Container Kernels
gVisor

Pod Security

Pod Security Policies
Deploy a PSP
Pod Security Standards
Enable PSS

Open Policy Agent (OPA)

Admission Controller
Create a LimitRange
Open Policy Agent
Policy as Code
Deploy Gatekeeper

User Administration

Contexts
Contexts
Authentication and Authorization
Role Based Access Control
Role Based Access Control
RBAC Distributing Access
Service Accounts
Limit Pod Service Accounts

Securing Secrets

Secrets
Create and Consume Secrets
Hashicorp Vault
Deploy Vault

Securing the Network

Networking Plugins
NetworkPolicy
Deploy a NetworkPolicy
mTLS
Linkerd
mTLS with istio
istio

Threat Detection

Active Threat Analysis
Host Intrusion Detection
Deploy OSSEC
Network Intrusion Detection
Deploy Suricata
Physical Intrusion Detection

Disaster Recovery