AppSecEngineer™ Certified Cloud-Native Security Bootcamp

• What cloud-native security means and why it’s crucial in today’s environments.
• The “4C” framework: Cloud, Cluster, Container, Code.
• Applying the Shared Responsibility Model across cloud platforms (AWS).
• Fundamentals of secure Infrastructure as Code and drift prevention.

‍

• Scanning Infrastructure as Code (IaC) templates for misconfigurations.
• Using AWS Access Analyzer to validate and remediate overly permissive IAM roles.
• Architecting secure cloud-native systems based on foundational principles.

‍

• The container threat landscape, including image tampering and privilege escalation.
• How vulnerability scanning in ECR and Inspector prevents common attacks.
• The role of image signing (cosign) in supply chain integrity.
• Translating user stories into “abuser stories” for risk analysis.

‍

• Scanning a container image, analyzing the vulnerability report, and remediating a critical CVE.
• Using cosign to sign and verify its image integrity.
• Configuring ECR to automatically scan images and block deployments based on high-severity findings.

‍

• Kubernetes threat modeling and common attack paths like misconfiguration and privilege escalation.
• Strategies for hardening EKS clusters using Pod Security, RBAC, and network policies.
• The critical role of real-time threat detection with GuardDuty for EKS Runtime.

‍

• Running kube-bench against an EKS cluster to audit and implement CIS-recommended hardening.
• Simulating a runtime threat, like a container escape, and responding to the resulting GuardDuty alerts.
• Enforcing least-privilege RBAC and modern Pod Security Standards to secure workloads.
• Configuring an event-driven workflow to automatically isolate a compromised pod upon threat detection.

‍

• Designing a unified monitoring architecture using CloudTrail, VPC Flow Logs, and Security Hub.
• Continuous compliance and evidence capture for audits (CIS, ISO 27001).
• Building event-driven, automated incident response with EventBridge and Lambda.
• Cloud misconfiguration detection and LLM security awareness.

‍

• Integrating findings from GuardDuty and Inspector into AWS Security Hub for centralized monitoring.
• Building a Lambda function triggered by EventBridge to automatically remediate a security misconfiguration.
• Deploying a multi-region, tamper-proof CloudTrail for comprehensive audit logging.
• Exporting consolidated findings from Security Hub to produce evidence for a mock audit.

‍