Before
- Firewall perimeter
- Static IP-based trust
- Manual security reviews
- Secrets in env vars
- Hope-based east-west security
Module 1 of 16
Introduction to Cloud Native Security
Why traditional security fails in cloud-native systems and how to think about modern infrastructure protection
Start here
Learning objectives
- Understand the evolution from monoliths to cloud-native platforms
- Learn why perimeter security fails with ephemeral workloads
- Map the cloud-native threat landscape
- Build a security-first engineering mindset
After
- Identity-based trust
- Cryptographic verification
- Policy-as-code automation
- Dynamic credential management
- Runtime threat detection
Cloud-native systems break every assumption of traditional security. Containers live for seconds. Pods get random IPs. Services span clusters, clouds, and regions. The network perimeter does not exist. Secrets sprawl across environment variables, ConfigMaps, and CI/CD pipelines.
This module builds your security mindset from the ground up. You will understand WHY traditional security fails, WHAT the modern threat landscape looks like, and HOW cloud-native security engineering addresses it.
The Evolution of Infrastructure
Infrastructure evolved through four eras, and security had to evolve with it:
- Monolith Era (1990s-2000s): One application, one server, one firewall. Security = guard the perimeter.
- VM Era (2000s-2010s): Multiple VMs, network segmentation, VLANs. Security = segment the network.
- Container Era (2010s-2020s): Docker, ephemeral workloads, dynamic IPs. Traditional security starts breaking.
- Cloud Native Era (2020s+): Kubernetes, service mesh, serverless. Security = identity + policy + runtime + supply chain.
Why Traditional Security Fails
In a Kubernetes cluster with 500 pods across 50 services, a pod restarts and gets a new IP every few hours. Auto-scaling creates replicas with no warning. Service mesh proxies route traffic through sidecars, masking the real source. A firewall rule for 10.0.1.50 is meaningless when that IP hosted the payment service 5 minutes ago and now hosts the logging service.
The Cloud Native Threat Landscape
- Container escapes: Breaking out of container isolation to access the host
- Kubernetes API abuse: Exploiting misconfigured RBAC to escalate privileges
- Supply chain attacks: Compromised base images or dependencies injecting malware
- Secret sprawl: Leaked credentials in logs, env vars, and Git history
- East-west attacks: Lateral movement between services inside the cluster
- Identity attacks: Impersonating services using stolen tokens or certificates
Core Security Principles
- Least Privilege: Every workload gets only the permissions it needs, nothing more
- Zero Trust: Never trust, always verify — regardless of network location
- Defense in Depth: Multiple overlapping security layers, not one wall
- Identity-First Security: Cryptographic identity, not network properties
- Shift Left: Security starts in the build pipeline, not after deployment
Real world
Where this shows up
- Securing production Kubernetes clusters from day one
- Building security-first internal developer platforms
- Preparing for SOC 2 and compliance audits
- Defending against lateral movement in multi-tenant clusters
Common mistakes
What usually breaks
- Assuming Kubernetes is secure by default (it is not)
- Using the default service account for all workloads
- Storing secrets in plain ConfigMaps or environment variables
- Deploying containers as root without resource limits
- Relying solely on network policies for east-west security
Key terms
Vocabulary used in this module
Cloud Native
Architecture designed for containers, microservices, and orchestration platforms like Kubernetes
Secret Sprawl
Uncontrolled proliferation of credentials across systems, configs, and pipelines
East-West Traffic
Service-to-service communication inside a cluster (vs north-south = external)
Defense in Depth
Multiple overlapping security controls so failure of one does not compromise the system
Shift Left
Moving security earlier in the development lifecycle (build-time, not runtime)
Labs
Hands-on labs
Exploring the Kubernetes Attack Surface
Identify security weaknesses in a default Kubernetes deployment.
- Deploy a Kind cluster with default settings
- List all service accounts and their permissions
- Access the Kubernetes API from inside a pod
- Document every security gap you find
Analyzing Insecure Deployment Examples
Review real-world insecure Kubernetes manifests and identify vulnerabilities.
- Review 5 intentionally insecure deployment manifests
- Identify the security issues in each
- Write hardened versions of each manifest
- Compare before and after with diff
Recap
Key takeaways
- Traditional perimeter security fails with ephemeral cloud-native workloads
- Cloud native security requires five pillars: identity, zero trust, policy, runtime, supply chain
- Least privilege and defense in depth are foundational principles
- The threat landscape includes container escapes, RBAC abuse, supply chain attacks, and lateral movement
- Security must shift left — it starts in the build pipeline, not after deployment
Related resources