Practical DevSecOps Logo

Certified Cloud Native Security Expert  (CCNSE)

The Certified Cloud-Native Security Expert (CCNSE) is a vendor-neutral cloud-native certification program in security. This Cloud-Native course covers topics in security such as Introduction to Cloud-Native Concepts and its Security, Containers, and Container Security, Introduction to Kubernetes, Hacking Kubernetes Cluster, Kubernetes Authentication and Authorization, Kubernetes Admission Controllers, Defending Kubernetes Cluster, Kubernetes Network Security, Kubernetes Data Security.

After the CCNSE Cloud-Native security training, you will be able to:

  • Build a solid foundation that is required to understand the container and Kubernetes security landscape.
  • Gain a practical understanding of how to hack misconfigured Kubernetes workloads.
  • Learn and implement different ways of Authentication and Authorization methods used in Kubernetes.
  • Experience Network security and Zero Trust in action using Network policies and Service Meshes.
  • Gain the necessary skills to Defend Kubernetes cluster from most common attacks.
Enroll Now
Watch Video
CCNSE

Top Rated Course

Check Out Reviews

  • Self-paced Learning Mode
  • Browser-based Lab Access
  • 24/7 Instructor Support via Mattermost

CCNSE Cloud Native Certification in security Prerequisites

  1. Course participants should have knowledge of running basic Linux commands like ls, cd, mkdir, etc.,
  2. Basic knowledge in container technology and k8s helps but is not needed.
  3. Understanding of OWASP Top 10 vulnerabilities

Chapter 1: Introduction to Cloud-Native Concepts and its Security

  1. Course Introduction (About the course, syllabus, and how to approach it) 
  2. About Certification and how to approach it
  3. Lab Environment
  4. Lifetime course support (Mattermost)
  5. Overview of the Cloud Native Technologies
  6. The 4C’s of Cloud-Native Security
    1. Cloud
    2. Clusters
    3. Containers
    4. Code (SCA, SAST, DAST) – DevSecOps
  7. Security and Threat Model of Cloud-Native technologies
    1. Overview of Cloud Security
    2. Overview of Container Security (Container Vulnerability, Supply Chain Attack, Least Privilege)
    3. Overview of Kubernetes Security
    4. Overview of Microservices Security
  9. Hands-on Exercise: Learn how to use our browser-based lab environment

Chapter 2: Introduction to Microservices Architecture

  1.  The need for microservices
  2.  Monolith vs Microservices
  3.  Technical and Business pros and cons of Microservices
  4.  Tools of the trade
      1. Source code management
      2. CI/CD tools
      3. Artefact management
      4. Cloud Platform
      5. Infrastructure as code
      6. Monitoring and logging tools
      7. Collaboration tools
  5. REST APIs
      1. What is an API
      2. API Security
      3. Introduction to OWASP API Top 10
        1. Software Component Analysis of API
        2. Static Application Security Testing of API
        3. Dynamic Application Security Testing of API
  6. Hands-on Exercises:
    1. Working With GitLab CI/CD
    2. Advanced GitLab CI/CD
    3. Continuous Deployment Using GitLab

Chapter 3: Containers and Container Security

  1. What is a container?
  2. Container vs Virtualization
      1. Container Advantages
      2. Container Disadvantages
  3. Docker Architecture and its components
      1. Command Line Interface(CLI)
      2. Engine (Daemon, API)
      3. Runtime (containerd, shim, runc)
  4. Basics of container technology and its challenges
  5. Container fundamentals
      1. Namespaces
      2. Cgroup
      3. Capabilities
  6. Ways to interact with container ecosystem
  7. Container security issues
  8. Container Defenses
  9. Hands-on Exercises:
    1. Working With Docker Command
    2. Create Docker Image Using Dockerfile
    3. Malicious Container Image
    4. Build a Secure, Miniature Image With Distroless To Minimize Attack Footprint
    5. How To Use Container Registry
    6. Attacking Misconfigured Docker Registry
    7. Signing Container Images for Trust
    8. Securing Container Using Seccomp
    9. Exploiting Containerized Application
    10. Docker Privilege Escalation

Chapter 4: Introduction to Kubernetes

  1. Introduction to Kubernetes
  2. Kubernetes Use Cases 
  3. Kubernetes Architecture (Core Components)
      1. Cluster, Nodes, and Pods
      2. API Server
      3. Controller Manager
      4. Etcd
      5. kube-scheduler
      6. kubelet
      7. Kube-proxy
      8. Container Runtime
  4. Bootstrapping the Kubernetes cluster
  5. Kubernetes Package Manager
      1. Understanding Helm Workflow
      2. Creating Helm Charts
  6. Hands-on Exercises:
    1. Bootstrapping the Kubernetes Cluster Using kubeadm
    2. Kubernetes Basics Component
    3. Working With Kubernetes
    4. Kubernetes Secrets
    5. Kubernetes Service Accounts
    6. Kubernetes Storage
    7. Kubernetes Networking Using Calico

Chapter 5: Hacking Kubernetes Cluster

  1. Kubernetes Attack Surface and Threat Matrix
  2. Common Kubernetes security issues
  3. Differences in k8s installations (support for PSP vs no PSP)
  4. Hands-on Exercises:
      1. Kubernetes Reconnaissance Through Port Scanning
      2. Hacking Kubernetes Using Kubernetes Dashboard
      3. Reconnaissance Using kube-hunter
      4. Crashing Kubernetes cluster
      5. Exploiting Kubelet API
      6. Exploiting Privileged Containers
      7. Compromising Kubernetes Secrets
      8. Supply Chain Attack Using Poisoned Image
      9. Supply Chain Attack Using Malicious Helm Chart
      10. Sniffing Kubernetes Network Traffic

    Chapter 6: Kubernetes Authentication and Authorization

    1. Fundamentals of Kubernetes Authentication and Authorization
    2. Authentication mechanisms in Kubernetes
        1. Authentication with Client Certificates
        2. Authentication with Bearer Tokens
        3. HTTP Basic Authentication
        4. Remote Authentication
    3. Authorization mechanisms in Kubernetes
        1. Node Authorization
        2. Attribute Based Access Control (ABAC)
        3. Role-Based Access Control (RBAC)
    4. Hands-on Exercises:
      1. Creating Kubernetes Users Using Certificates
      2. Kubernetes Authentication Using Keycloak
      3. Find Misconfigured RBAC Using KubiScan
      4. Static Analysis of the Access Control Using Krane

    Chapter 7: Kubernetes Admission Controllers

    1. Fundamentals of Admission Controllers
    2. Static Admission Controllers
        1. LimitRanger
        2. DefaultStorageClass
        3. AlwaysPullImages
    3. Dynamic Admission Controllers
        1. Introduction to Custom Admission Controllers
        2. Working with Custom Admission WebHooks
        3. Authenticating API Servers
        4. Open Policy Agent (OPA) and Rego Policies
        5. Using OPA with Kubernetes
        6. OPA Gatekeeper
        7. OPA Kube-mgmt vs OPA Gatekeeper
    4. Pod Security Context
    5. Pod Security Policies 
    6. Pod Security Admission
        1. Pod Security Standards
        2. Policy Modes
        3. Applying Policies
    7. Different Options to Write Custom Policies for K8s
    8. Hands-on Exercises:
      1. Enforcing Custom Resource Limits With LimitRanger
      2. Enforcing Images Are Always Pulled With Authorization
      3. Enforced Trusted Images Using OPA Gatekeeper

    Chapter 8: Kubernetes Data Security

    1. Kubernetes Data Storage mechanisms
        1. Image Layers
        2. Container Mounts and Volumes
        3. Distributed Volumes in Kubernetes
        4. Persistent Volumes on Cloud
        5. Dynamically Provisioning Cloud Storage for Workloads
    2. Managing secrets in traditional infrastructure
    3. Managing secrets in containers at Scale
        1. Exploring Secret Storage Options
        2. Kubernetes Secrets Object
        3. Encrypted Configurations
        4. Managing Encryption Keys in External KMS
        5. Encrypting Secret Objects in Version Control Systems
        6. Mozilla SOPS for Secret OPerationS
        7. Introducing Secrets Store CSI Drivers
        8. Environment Variables and Volume Mounts
        9. Injecting Secrets with Hashicorp Vault
    4. Sanning for Secrets Exposure
    5. Hands-On Exercises: 
      1. Encrypting Kubernetes Secrets at Rest
      2. Storing Secrets Securely Using HashiCorp Vault
      3. Managing Secrets Using Sealed Secrets
      4. Kubernetes Image Scanning Using Trivy

    Chapter 9: Kubernetes Network Security

    1. Introduction to Kubernetes Networking
        1. Kubernetes Networking Architecture
        2. Challenges with Kubernetes Networking
    2. Network Policies in Kubernetes
        1. Network Policy and Its Characteristics
        2. Anatomy of a Network Policy
    3. Fallacies of Distributed Computing
    4. Service Mesh Architecture
        1. Exploring Linkerd
        2. Zero Trust with Consul Connect
        3. Service Identities with Istio
    5. Hands-on exercises:
      1. Writing Network Policies in Kubernetes
      2. Kubernetes Ingress Using NGINX Ingress
      3. Implementing a Service Mesh and mTLS With Istio
      4. Implementing a Service Mesh With Linkerd
      5. Enforce Zero Trust Networking Using Consul Connect

    Chapter 10: Defending Kubernetes Cluster

    1. Compliance and Governance
        1. Kubernetes Compliance with Kubebench
        2. Kubernetes Compliance with Inspec
    2. Threat Modeling for Kubernetes
    3. Static Analysis of Kubernetes clusters
    4. Building Secure Container Images
    5. Dynamic and Runtime Security Analysis
    6. Security Monitoring
    7. Hands-on Exercises:
      1. Principle of Least Privileges Using Role-Based Access Control
      2. Kubernetes Static Analysis
      3. Performing Static Analysis of Manifest Files in CI/CD Pipeline
      4. Defining Kubernetes Resource Quotas
      5. Kubernetes Compliance Using CIS Benchmarks
      6. Securing Kubernetes Workloads Using gVisor
      7. Security Monitoring of Kubernetes Cluster Using Wazuh
      8. Kubernetes Threat Detection Using Falco
      9. Threat Hunting With Kubernetes Audit Logs

    Cloud-Native Security Certification Process

    1. After completing the course, you can schedule the CCNSE exam on your preferred date.
    2. Process of achieving Practical DevSecOps CCNSE Certification can be found here.
    Enroll Now
    Back to Course List