Workload, Container, and Application Security
This domain tests protection of compute and application artifacts: VMs, containers, Kubernetes, serverless, and the software supply chain.
Core rules
- Build from hardened, minimal images; patch and rescan continuously; prefer immutable infrastructure.
- Scan images, dependencies, and IaC in the pipeline; sign artifacts and verify signatures at admission.
- Kubernetes: use RBAC least privilege, network policies, pod security standards, admission controllers, and avoid privileged pods. Keep secrets in external vaults.
- Serverless: scope function roles tightly, validate inputs, and monitor invocation patterns.
- Runtime protection (CWPP) complements build-time scanning; it does not replace it.
Worked example
A container runs as root with a writable filesystem and the latest tag. The team replaces it with a distroless image, a non-root user, a read-only root filesystem, dropped capabilities, and a pinned digest. They add an admission policy that rejects privileged pods and unsigned images. Reasoning: removing root and write access reduces escape impact, while admission control enforces the rule even when a developer forgets.
Traps
- Scanning only at runtime after deployment.
- Using latest tags and mutable images.
- Storing secrets in environment variables or ConfigMaps.
- Granting cluster-admin for convenience.