Certified Kubernetes Security Specialist (CKS)

Duration

Certified Kubernetes Security Specialist (CKS)

3 days

Overview

The Certified Kubernetes Security (CKS) Workshop is an intensive, hands-on training program designed to equip participants with the skills and knowledge necessary to secure Kubernetes clusters and applications. This workshop covers critical security concepts and best practices to ensure a robust and secure Kubernetes environment.

Participants will learn how to implement security controls, perform vulnerability assessments, and monitor

Kubernetes infrastructure effectively.

Learning Objectives

By the end of this workshop, participants will be able to:

• 1. Implement network security policies to control access within a Kubernetes cluster.
• 2. Use the CIS benchmark to evaluate and improve the security configuration of Kubernetes

components.

• 3. Set up secure Ingress objects and protect node metadata and endpoints.
• 4. Minimize exposure to GUI elements and verify platform binaries before deployment.
• 5. Restrict API access and implement Role-Based Access Controls (RBAC).
• 6. Secure service accounts and maintain an updated Kubernetes environment.
• 7. Harden the host operating system and kernel to reduce attack surfaces.
• 8. Secure microservices by managing secrets and implementing pod-to-pod encryption.
• 9. Protect the software supply chain and validate container images.
• 10. Monitor and analyze runtime activities to detect and respond to security threats.

Audience

This workshop is designed for Kubernetes administrators, DevOps engineers, security professionals, and IT operations staff who are responsible for managing and securing Kubernetes environments.

Course Outline ::CKS::

Module 1: Cluster Setup

Implementing Network Security Policies o Restricting cluster-level access using network policies.

Reviewing Security Configurations o Using CIS benchmarks to review Kubernetes components such as etcd, kubelet, kubedns, and kubeapi.

Securing Ingress Objects o Properly setting up Ingress with security controls.

Protecting Node Metadata and Endpoints o Techniques to secure node metadata and endpoints.

Minimizing GUI Access o Reducing reliance on GUI elements for security.

Verifying Platform Binaries o Ensuring binaries are verified before deployment.

Module 2: Cluster Hardening

Restricting Kubernetes API Access o Implementing controls to restrict API access.

Role-Based Access Controls (RBAC) o Using RBAC to minimize exposure.

Managing Service Accounts o Best practices for managing and securing service accounts.

Updating Kubernetes o Strategies for keeping Kubernetes updated and secure.

Module 3: System Hardening

Minimizing Host OS Footprint o Reducing the attack surface by minimizing the host OS footprint.

Minimizing IAM Roles o Strategies for minimizing IAM roles.

Restricting Network Access o Limiting external access to the network.

Kernel Hardening Tools o Using tools like AppArmor and seccomp for kernel hardening.

Module 4: Minimizing Microservice Vulnerabilities

Course Outline ::CKS::

Setting Up OS Level Security Domains o Implementing security domains at the OS level.

Managing Kubernetes Secrets o Best practices for managing secrets within Kubernetes.

Using Container Runtime Sandboxes o Implementing sandboxes like gvisor and kata containers in multi-tenant environments.

Implementing Pod-to-Pod Encryption o Using mTLS for pod-to-pod encryption.

Module 5: Supply Chain Security

Minimizing Base Image Footprint o Strategies to reduce the base image footprint.

Securing the Supply Chain o Whitelisting registries, signing, and validating images.

Static Analysis of Workloads o Using static analysis tools for Kubernetes resources and Docker files.

Scanning Images for Vulnerabilities o Techniques for scanning container images for known vulnerabilities.

Module 6: Monitoring, Logging, and Runtime Security

Behavioral Analytics o Analyzing syscall processes and file activities to detect malicious activities.

Threat Detection o Detecting threats within the infrastructure, applications, networks, data, users, and workloads.

Attack Detection and Response o Identifying and responding to all phases of an attack.

Analytical Investigation o Performing deep analytical investigation to identify bad actors.

Ensuring Container Immutability o Ensuring containers remain immutable during runtime.

Using Audit Logs o Monitoring access through audit logs.

Course Outline ::CKS::

Prerequisites

The Certified Kubernetes Security Specialist (CKS) exam is a performance-based certification exam that tests candidates' knowledge of Kubernetes and cloud security in a simulated, real world environment. Candidates must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS exam.

CKS may be purchased but not scheduled until CKA certification has been achieved. CKA Certification must be active

(non-expired) on the date the CKS exam (including Retakes) is scheduled.

Programme scope, delivery arrangements and suitability are confirmed during enquiry.