CNCF [Cloud Native Computing Foundation] Courses

Keyless Code Signing Without Fulcio

Explore keyless code signing without Fulcio, understanding its benefits and implementing it with existing PKI solutions like Vault and stepca for hassle-free, secure software signing.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Container Factory for Aerospace and Defense Enterprises

Explore how Collins Aerospace develops a container factory to meet governance and compliance rules for safety-critical software, addressing challenges and integrating innovative solutions for cybersecurity and compliance.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Spicing up Container Image Security with SLSA and GUAC

Explore SLSA and GUAC tools to enhance container image security, verify build provenance, and understand artifact composition for safer deployments in production environments.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Sharing Security Secrets: How to Encourage Security Advocates

Discover strategies for fostering a company-wide security culture, educating non-security teams, and implementing a successful security advocates program to enhance organizational data protection and service availability.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Learning from Supply Chain Failures and Best Practices in Other Industries

Explore supply chain best practices and failures across industries to enhance software supply chain security. Gain insights from physical world processes and apply lessons to critical infrastructure protection.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

12 Essential Requirements for Policy Enforcement and Governance with OSCAL

Explore policy enforcement and governance in Kubernetes using OSCAL. Learn 12 key requirements for multi-cluster environments, focusing on security, compliance, and policy-as-code practices.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Verifying Software Signatures with TUF and Sigstore

Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Leveraging SBOMs to Automate Packaging, Transfer, and Reporting of Dependencies Between Secure Environments

Explore innovative uses of Software Bill of Materials (SBOMs) for secure asset transfer, dependency management, and cloud-native infrastructure deployments using CycloneDX and open-source tools.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Security Threat Modeling Live from Scratch Session

Hands-on workshop demonstrating lightweight threat modeling for CNCF projects, led by Andrew Martin. Learn practical techniques to identify and mitigate security risks in cloud-native environments.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

CNI or Service Mesh? Comparing Security Policies Across Cloud Native Networking Solutions

Explore recent changes in cloud native networking solutions, comparing CNI and service mesh implementations for security policies, and understanding trade-offs between different approaches.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Security++ - Hide Your Secrets via Distributed Hardware Security Module

Explore distributed Hardware Security Modules for enhanced cloud security and performance. Learn how this solution balances remote and local HSMs, enabling secure cryptographic operations across cloud, on-premise, and edge environments.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Taming Attestation for Cloud Native Edge Security with Parsec

Explore how Parsec simplifies hardware-backed security and attestation for edge devices, enabling secure communication with cloud services across diverse ecosystems.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Mapping Motives: Analysis of 2,000 Enterprise Cloud Detections - Strengthening Multi-Cloud SOC

Analysis of 2,000 cloud detections reveals enterprise control patterns, gaps, and attacker motives. Learn to strengthen multi-cloud security operations with actionable insights and MITRE ATT&CK framework application.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Securing the Superpowers: Who Loaded That eBPF Program?

Explore eBPF technology's power and security implications. Learn about auditing, monitoring, and enforcing eBPF program loading on Linux systems using Tetragon for enhanced system protection and accountability.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Lessons from 7 Headline-Grabbing Cloud Security Breaches

Analyze 7 real cloud security breaches, exploring attack methods, defense strategies, and specific takeaways to enhance cloud infrastructure protection and avoid similar vulnerabilities.

• YouTube
• 32 minutes
• Self-Paced
• Free Video