Security Index
Welcome to the Security knowledge base. This section focuses on DevSecOps, infrastructure hardening, and modern identity-first security patterns.
📂 Subtopics
- DevSecOps Fundamentals: Shift left, security-as-code, and the DevSecOps pipeline mindset. Source: DevOps to DevSecOps in 9 Hours
- Shift Left Security: Economic and operational rationale for embedding security early in the SDLC.
- Threat Modeling: STRIDE methodology and OWASP Threat Dragon for design-time risk analysis.
- Container Security: Docker hardening, image scanning with Trivy, and Kubernetes runtime protection.
- SAST, DAST, and SCA: Static, dynamic, and composition analysis pipeline gates.
- GitOps Security: Securing repositories, workflows, secrets, and the software supply chain.
- Kyverno: Kubernetes-native policy engine — YAML-driven dynamic admission control for cluster governance (validate, mutate, generate, verifyImages). Source: Enforce Kubernetes Security with Kyverno
- Falco: CNCF-graduated runtime security engine — eBPF syscall monitoring, declarative rules, DaemonSet or host deployment. Source: Falco for Kubernetes Security — CKS Scenarios
- Runtime Security: Detecting threats while workloads execute — the third phase after build-time and admission-time controls.
- CKS Certification: Certified Kubernetes Security Specialist — cluster hardening, supply chain, and Falco runtime scenarios.
- Kubernetes Admission Controllers: The API-server policy gate — validating/mutating webhooks, built-in controllers, and the governance scaling problem.
- Zero Trust Access: IAP, Teleport, and identity-aware gating.
- Cloud-Security: AWS IAM, S3 hardening, and VPC security.
- TLS Fundamentals: Certificates, handshake, cipher suites, and PKI.
- Kubernetes RBAC: Role-based access control for K8s namespaces and clusters, including ClusterRoles and ClusterRoleBindings.
- Kubernetes Authentication & Authorization: API server security pipeline.
- Network-Security: WAF, mTLS, and DDoS mitigation.
- AI Security: Securing agentic workflows, SAST for AI code, and hybrid governance.
Last Updated: 2026-07-20 (Falco / Runtime Security / CKS added)