1 Prerequisites This skill 0 Unlocked

Skill · Security · Go deeper into end-to-end security

Control what reaches production and detect deviations at runtime

Control what reaches production and what happens there: promote the same artifact, enforce policies on IaC and Kubernetes admission (Kyverno, signature verification, Pod Security Standards), encrypt secrets in Git with SOPS, segment the network, detect with Falco and check compliance with CINC Auditor.

Start lesson 1The Security domain

• 9 lessons
• ~7 h 15 of reading
• 8 quizzes
• 1 proof lab

The path

Where it comes from, where it leads

What you need to know first, where you stand on this skill, and what it opens next. Your status is computed in your browser, from what you have read and passed.

Before · 1 prerequisite

• Detect and contain at runtime

This skill, for you

Control what reaches production and detect deviations at runtime

Computing

It unlocks · nothing yet

No other skill requires it: it is an end-of-path skill.

Lessons

How to learn it

9 lessons, about ~7 h 15, in program order. Each lesson ends with its quiz.

The program

9 lessons · ~7 h 15

Part 1 · Build, containers and IaC 2 lessons · ~1 h 20

1. 1Promoting an artifact: build once, deploy twice· 30 min
2. 2Policy as code and governance in HCP Terraform· 50 min

Part 2 · Controlled deployment 3 lessons · ~2 h 30

1. 3SOPS: encrypting your secrets in Git· 30 min
2. 4Kyverno, the Kubernetes policy engine in YAML and CEL· 30 min
3. 5Kubernetes supply chain security: securing the delivery chain· 90 min

Part 3 · Runtime security 3 lessons · ~3 h 05

1. 6Pod Security Standards (PSS): securing Kubernetes workloads· 35 min
2. 7Kubernetes NetworkPolicies: isolating traffic between Pods· 125 min
3. 8Falco - Runtime threat detection in Kubernetes· 25 min

Part 4 · Vulnerabilities, exceptions and compliance 1 lesson · ~20 min

1. 9CINC Auditor: scanning the compliance of your containers· 20 min

Beyond the lessons

Assess, practise, pass the proof

Reading a lesson confirms nothing. A skill is confirmed by a passed quiz, practised in a guided lab, and put to the test by a challenge or a mission; an imported lab result is not verified by the site.

Assess yourself

8 quizzes

At the end of the lessons: passed at 70%, they confirm the skill.

Practice

8 guided labs

• Isolate the database: only the backend gets in
• Partition three tiers with ingress and egress NetworkPolicy
• Sign an image, and prove the signature by having another one refused
• Fix a Dockerfile static analysis refuses, without changing the application
• Pin an image by digest, and prove the tag is not enough
• Deny everything, then reopen the strict minimum, DNS included
• Reject a privileged Pod at admission, with Pod Security Admission
• Policy as code: what blocks a run, and who can override it

Proof

1 practical proof

• V8, admission: the cluster refuses what the platform did not sign

A practical proof is a challenge, a capstone or a declared lab.

Used by the mission “Refuse the unknown and contain the runtime”, which has its proof.

Going further

• Falco vs Tetragon : comparés sur le même cluster (in French)

Reference pages: they support the skill without teaching it, and do not count in your journey.

Around it

Who requires it, who teaches it

Required by

• DevSecOps Engineer

Taught by

• DevSecOps Training

Same block · Go deeper into end-to-end security

• Analyse an application with specialised scanners: secrets, SAST, dependencies, Scorecard and DAST
• Analyse an attack on a pipeline: secrets, hijacked tools and provenance

×

See in the glossary →