Certified Kubernetes Security Specialist (CKS) Course Overview

To successfully undertake training in the Certified Kubernetes Security Specialist (CKS) course, students should have the following minimum prerequisites:

• A strong understanding of Kubernetes fundamentals, including pods, services, and basic networking concepts.
• Experience with Kubernetes cluster administration, including setting up and managing a cluster.
• Familiarity with Linux/Unix command-line tools and basic shell scripting.
• Knowledge of basic security concepts, such as access controls and network security.
• Experience with containerization technologies, particularly Docker.
• Familiarity with YAML and JSON formats for Kubernetes resource definitions.
• Understanding of the principles of DevOps and CI/CD practices is beneficial.
• Completion of the Certified Kubernetes Administrator (CKA) certification or equivalent experience is highly recommended, as CKS builds upon the skills required for CKA.

Please note that the CKS exam assumes that the candidate has already passed the CKA exam, and the CKS exam environment will include a set of Kubernetes clusters that require the use of CKA-level skills to solve security-related tasks.

Target Audience for Certified Kubernetes Security Specialist (CKS)

The Certified Kubernetes Security Specialist (CKS) course is designed for IT professionals focused on Kubernetes cluster security and best practices.

• Kubernetes Administrators
• DevOps Engineers
• Cloud Security Engineers
• Cloud Architects
• Site Reliability Engineers (SREs)
• Security Analysts and Architects focusing on containerized environments
• IT Security Professionals
• Infrastructure Security Engineers
• Application Developers with a focus on DevSecOps
• System Administrators looking to specialize in container orchestration security
• Compliance Managers dealing with container-based deployments
• Technical Leads overseeing Kubernetes infrastructure

Learning Objectives - What you will Learn in this Certified Kubernetes Security Specialist (CKS)?

Introduction to Course Learning Outcomes

The Certified Kubernetes Security Specialist (CKS) course equips participants with best practices and skills to secure container-based applications and Kubernetes platforms during build, deployment, and runtime.

Learning Objectives and Outcomes

• Verify the integrity of Kubernetes platform binaries to ensure secure deployment.
• Implement access restrictions to Kubernetes API to minimize unauthorized access risks.
• Apply Role-Based Access Control (RBAC) to enforce the principle of least privilege.
• Manage service accounts diligently, disable defaults, and restrict permissions for new accounts.
• Keep Kubernetes updated to mitigate vulnerabilities and enhance security features.
• Reduce the host operating system's attack surface to fortify cluster security.
• Limit IAM roles and permissions to the minimum required for operational efficiency.
• Restrict external network access and implement network security best practices.
• Utilize kernel hardening tools like AppArmor and Seccomp to protect against exploits.
• Configure OS-level security domains using PSP, OPA, and Security Contexts to isolate and secure workloads.
• Effectively manage Kubernetes secrets for sensitive data protection.
• Employ container runtime sandboxes in multi-tenant environments to isolate workloads.
• Implement mutual TLS (mTLS) for secure pod-to-pod communication.
• Optimize base images to reduce vulnerabilities and ensure a secure foundation for containerized applications.
• Secure the supply chain by using trusted registries, signing images, and validating image signatures.
• Conduct static analysis on user workloads and scan images for known vulnerabilities.
• Monitor and analyze system calls, file activities, and behavioral patterns to detect malicious activities.
• Identify threats within the infrastructure, applications, networks, data, users, and workloads across all attack phases.
• Conduct in-depth investigations to identify and address security breaches.
• Ensure container immutability at runtime and utilize audit logs for monitoring and compliance.