Operational Security - Hardening, Infrastructure, Runtime, and Resilience
What this domain covers
Operational security covers running systems safely after deployment: hardening, patch and image management, infrastructure as code, cloud and Kubernetes configuration, production access, network controls and resilience. Questions often describe a runtime weakness that build-time controls could not prevent.
Core rules
- Hardening starts from CIS Benchmarks and minimal images: remove unused services, run as non-root, use read-only filesystems, and keep secure defaults.
- Patch with severity-based service levels and automation. Prefer immutable infrastructure: rebuild golden images from a patched base rather than patching running hosts, so drift cannot accumulate.
- Infrastructure as code is scanned before apply and policed at admission. Tools such as Checkov or tfsec catch misconfiguration in review; OPA Gatekeeper or Kyverno reject non-compliant workloads at the cluster boundary; drift detection catches manual changes.
- Cloud security posture management finds exposed storage, permissive security groups and stale identities. Every finding needs an owner, or it becomes noise.
- Kubernetes: signed and scanned images, digest pinning instead of mutable tags, network policies, tight RBAC, secrets injected at runtime rather than baked into images, and runtime detection with eBPF or Falco-style tooling.
- Edge and network: WAF, DDoS protection, segmentation, mutual TLS between services. Blanket egress blocks break applications; allow lists work better.
- Production access: no standing access, just-in-time elevation, session recording, break-glass with alerting.
- Resilience is a security property: tested backups, disaster recovery exercises, canary and blue-green releases, feature flags and kill switches limit blast radius. Chaos engineering validates assumptions deliberately.
- Continuous production scanning is required because new CVEs affect unchanged code.
Worked example
A cluster scans images at build, but manifests reference the mutable latest tag and the cluster pulls on restart, so unreviewed code can run. Reasoning: build-time assurance is invalidated by a mutable reference; the scan certified an image that is no longer the one running. The fix pins images by digest, adds an admission policy rejecting latest and unsigned images, restricts the registry to an allow list, and records the deployed digest for traceability. Scanning continues, but the artifact identity is now enforced at runtime.
Traps that cost marks
- Scanning once at build and assuming the workload stays safe as new vulnerabilities are disclosed.
- Leaving CSPM findings unowned and unprioritized.
- Patching mutable hosts in place and calling it immutable infrastructure.
- Blocking all egress and breaking the application, or allowing all egress and calling it segmentation.
- Assuming a network perimeter protects internal services.