Cloud Security | Cycerone

96 hours to complete

Scheduled hours: 24 hours
Estimated study hours: 72 hours

Advanced

Advanced experience required

Online

Instructors

Carlo Ramponi
Researcher
Luigi Dell'Eva
Researcher

Language

English
Subtitles: English, Italiano

This course introduces cloud-native security from the ground up through a combination of targeted theory and hands-on exercises. It begins by explaining how Linux containers actually work, starting from virtualization and progressing through the kernel mechanisms used to isolate and manage containerized processes, including namespaces, cgroups, filesystems, networking, and container images. Learners then use these mechanisms directly and explore how Docker automates their configuration. The course then focuses on container security. Learners study Linux capabilities, seccomp, AppArmor and SELinux, container runtime permissions, root and rootless execution, filesystem and device exposure, and the security implications of dangerous Docker configurations. Particular attention is given to container images and the software supply chain, including secure Dockerfiles, dependency and vulnerability scanning, image provenance, secrets management, and security controls that can be integrated into CI/CD pipelines. The final part introduces Kubernetes and its security model. Learners study the Kubernetes control plane, workloads, ServiceAccounts, RBAC, secrets, admission and pod security controls, network exposure, and common privilege-escalation paths caused by misconfiguration. Practical exercises require learners to inspect and reason about the boundaries between containers, pods, nodes, and the Kubernetes control plane, and to apply appropriate hardening measures. After completing the course, participants will understand how container isolation is implemented, how it can be weakened by configuration errors, and how to systematically secure containerized applications from the image build process through deployment and orchestration.

Learning Objectives

Explain how Linux namespaces, cgroups, filesystems, networking, and container runtimes are combined to implement Docker containers.
Analyse container configurations and identify weak or unnecessarily exposed isolation boundaries.
Apply Linux and Docker security mechanisms such as capabilities, seccomp, LSM policies, non-root execution, resource restrictions, and safer filesystem and device configurations.
Assess container images and build pipelines for insecure Dockerfiles, vulnerable dependencies, exposed secrets, excessive software, and supply-chain risks, and integrate appropriate checks into CI/CD workflows.
Explain the Kubernetes architecture and security model, including ServiceAccounts, RBAC, secrets, workload privileges, admission controls, and network exposure.
Analyse Kubernetes workloads and cluster configurations to identify privilege-escalation paths and apply defence-in-depth hardening across containers, images, runtimes, and orchestration.

Prerequisites

Basic understanding of cloud computing concepts, including IaaS and PaaS models. Familiarity with networking fundamentals, Linux command-line usage, basic scripting such as Python, and general cybersecurity principles is recommended.

Topics dealt with

Offensive SecuritySecure Development

Modules

Linux Container Internals and Docker

24 hours to complete

Scheduled hours: 6h

Estimated study hours: 18h

- Virtual infrastructure, full virtualization, and the distinction betweenvirtual machines and OS-level containers.• Linux processes and /proc; PID, mount, UTS, IPC, user, cgroup, andnetwork namespaces. - Cgroups v2 for CPU, memory, PID, I/O accounting, and resourcecontrol. - Container root filesystems, chroot, OverlayFS copy-on-write, imagelayers, writable layers, volumes, and bind mounts.• Network namespaces, veth pairs, Linux bridges, routing, NAT,Docker networks, and port publishing. - Docker object lifecycle, Dockerfiles and image builds, containerd,runc, and OCI image/runtime concepts.

Container Security and Secure Supply Chains

24 hours to complete

Scheduled hours: 6h

Estimated study hours: 18h

- Container threat models, trust boundaries, application compromise,and the distinction between compromise, exposure, lateralmovement, and host escape. - UID/GID identity, root and rootless execution, user namespaces,Linux capabilities, capability sets, and no-new-privileges.• Seccomp syscall filtering; Linux Security Modules; AppArmor andSELinux policy; read-only and masked paths; device restrictions. - Runtime and daemon security, privileged containers, hostnamespace sharing, sensitive mounts, devices, runtime sockets,network exposure, and availability limits. - Image and CI/CD security: Dockerfile design, BuildKit secrets, multi-stage builds, minimal images, tags and digests, scanning, SBOMs,provenance, signatures, and registry trust. - Runtime secret delivery, escape taxonomy, rootless mode, strongerisolation, monitoring, and operational hardening.

Kubernetes Security

24 hours to complete

Scheduled hours: 6h

Estimated study hours: 18h

- Kubernetes control-plane and node architecture, API server, etcd,controllers, scheduler, kubelet, runtime integration, and componenttrust boundaries. - Pods, workloads, namespaces, resources, Services, volumes, andthe relationship between Kubernetes abstractions and containerisolation. - Kubeconfig identities, ServiceAccounts, projected tokens, RBACroles and bindings, authorization checks, and privilege-escalationpatterns. - Security contexts, workload identity, capabilities, seccomp, Linuxsecurity profiles, Pod Security controls, admission, and workloadhardening. - Cluster networking, service discovery, ingress/egress exposure,NetworkPolicy, tenant boundaries, logging, auditing, and defence indepth.

From Kubernetes to the Cloud

12 hours to complete

Scheduled hours: 3h

Estimated study hours: 9h

- Managed-Kubernetes cloud boundary, shared-responsibility layers,and provider-neutral mappings across major cloud platforms. - The separation between Kubernetes RBAC and cloud IAM; control-plane, node, kubelet, and workload identities. - Temporary credentials, instance metadata services, node-roleexposure, and the security impact of node compromise. - Workload identity federation using projected ServiceAccounttokens, trust rules, audiences, subjects, short-lived credentials, andleast-privilege IAM. - Attack paths from a compromised Pod to node or workloadidentities, cloud resources, stronger identities, and persistent impact. - Cloud audit evidence, identity and data-event correlation, andcontrols that break each transition from application to Pod, cluster,node, identity, and resource.

Build your expertise

This course is part of the following learning pathways: Secure Software & DevSecOps, Penetration Tester

Cybersecurity skills are not built in a single session. Following a structured learning pathway helps you develop a complete and consistent skill set: step by step, at your own pace.

Not sure where to start?

Learn how the Cycerone portal works, how courses and learning pathways are organized, and how to find the training opportunities that best match your needs.

Discover how it works

96 hours to complete

Advanced

Online

Instructors

Carlo Ramponi

Researcher

Luigi Dell'Eva

Researcher

Language

Learning Objectives

Prerequisites

Topics dealt with

Modules

Linux Container Internals and Docker

24 hours to complete

Container Security and Secure Supply Chains

24 hours to complete

Kubernetes Security

24 hours to complete

From Kubernetes to the Cloud

12 hours to complete

Build your expertise

This course is part of the following learning pathways: Secure Software & DevSecOps, Penetration Tester

Not sure where to start?