Shift Left (Preventive) Security for Containers/Kubernetes

Accompanying repo for my talk on Shift-Left Security in a Containerized World at DevOps World conference

🔥 You can access the slides here 🖱️

My Other Related Repos

• Container Security Best Practices
• Container Security Checklist with Risk Scores
• Fun: Container from Scratch

“An ounce of prevention is worth a pound of cure” - Benjamin Franklin

Security Tools for Different SDLC Stages

Development Security

Code Scanning

• GoSec (Go)
• Bandit (Python)
• NodeJsScan (NodeJS)
• SpotBugs (Java)

Kubernetes Manifest Scanning

• KubeSec
• Prisma Cloud IaC

Container Image Scanning

• Prisma Cloud Compute
• JFrog
• Clair

CI/CD Pipeline Security

Code Scanning (same as above)

DAST

• OWASP ZAP
• Arachni

IAST

• Contrast Community Edition (CE)

Kubernetes Manifest Scanning (same as above)

Container Image Scanning (same as above)

Pre-deployment Security

Kubernetes Admission Controller

• Prisma Cloud Compute
• Open Policy Agent
• Pod Security Policy

Security Gates

• Binary Authorization

Runtime Security

Network Security

• CN-series
• Calico
• Istio
• Prisma Cloud Compute
• HashiCorp Consul

Behavior Security

• Prisma Cloud Compute
• Falco

Access Security

• IAM Analyzer
• RBAC

Sandboxing

• gVisor
• Kata Containers
• Nabla Containers

OS Hardening

• Google Container-Optimized OS

Reference Architecture Using Prisma Cloud and CN-Series