Securing Cloud-Native Delivery

What you will be able to do

• You will be able to threat model a cloud-native delivery pipeline and map controls across the code, build, artifact, deploy, and runtime stages.
• You will be able to reach SLSA build levels with hardened, ephemeral build environments, isolated pipeline identity, and tamper-evident provenance.
• You will be able to sign artifacts and generate and verify SBOMs using Sigstore, cosign, and SPDX or CycloneDX, and enforce verification before deploy.
• You will be able to harden a Kubernetes cluster with CIS Benchmark baselines, least-privilege RBAC, and a locked-down API server and kubelet.
• You will be able to enforce workload security with Pod Security Standards, network policies, admission control, and secrets and workload identity.
• You will be able to verify artifact signatures and SLSA provenance at the admission gate using policy as code with Kyverno or OPA Gatekeeper.
• You will be able to detect and respond to runtime threats using eBPF and Falco, drift detection, seccomp, AppArmor, and dropped capabilities.
• You will be able to implement compliance as code, mapping controls to NIST 800-190, NIST 800-53, and SOC 2, and automating evidence with OSCAL.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   Securing the Software Supply Chain

   Cloud-native attacks increasingly enter through the build, not the running app, so the first job is making everything you ship provable. This module threat models the delivery pipeline (dependency confusion, poisoned builds, and the OWASP CI/CD risks), raises build integrity with SLSA levels, hardened and ephemeral runners, and least-privilege pipeline identity, then makes each artifact tamper evident with Sigstore signing, SBOMs in SPDX or CycloneDX, and verifiable provenance you can check later at the gate.

   2 lessons · 5 quiz questions

2. 02

   Hardening Kubernetes

   Kubernetes is where cloud-native workloads run, and its defaults favor convenience over safety. This module hardens the cluster from the control plane outward: CIS Benchmark baselines, a locked-down API server and kubelet, and least-privilege RBAC that resists privilege escalation. It then secures the workloads themselves with Pod Security Standards, network policies for east-west segmentation, disciplined secrets handling, and workload identity in place of long-lived credentials.

   2 lessons · 5 quiz questions · assignment

3. 03

   Secure Admission and Runtime Defense

   A signed artifact only helps if the cluster refuses everything unsigned, so this module turns supply-chain trust into an enforced gate. You verify image signatures and SLSA provenance at Kubernetes admission using policy as code with Kyverno or OPA Gatekeeper, wire that check into a GitOps delivery flow, then defend the running workload with eBPF and Falco detection, drift detection, and runtime least privilege through seccomp, AppArmor, and dropped capabilities, closing with a container incident response playbook.

   2 lessons · 5 quiz questions

4. 04

   Compliance as Code and Continuous Assurance

   Passing an audit once means little if the platform drifts the next day, so this final module makes compliance a property of the pipeline itself. You express controls as version-controlled policy and enforce them as automated guardrails in CI and at admission, using CIS Benchmarks, kube-bench, and Pod Security to check posture continuously. You then map those controls to NIST 800-190, NIST 800-53, and SOC 2, automate machine-readable evidence with OSCAL, and manage exceptions and drift so assurance holds in the gaps between audits.

   2 lessons · 5 quiz questions · assignment