CNCF [Cloud Native Computing Foundation] Courses

Package Transparency for WebAssembly Registries

Explore WebAssembly package distribution with warg, a new registry protocol offering enhanced supply chain security through Package Transparency, verifiable data structures, and easy detection of operator compromise.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Get Your Security Priorities Straight - Identifying Workloads Under Real Threat with Context

Discover a security prioritization system for Kubernetes workloads based on the MITRE framework, helping differentiate real threats from potential ones in various contexts.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

OmniBOR: Bringing the Receipts for Supply Chain Security

Discover OmniBOR, a revolutionary approach to capture artifact dependency graphs in software development, enhancing supply chain security and reducing false positives in vulnerability scanning.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

From the Cluster to the Cloud: Lateral Movements in Kubernetes

Explore techniques for lateral movement from Kubernetes containers to cloud resources, covering RBAC misconfigurations, authentication methods, and real-world incidents. Learn prevention and detection strategies.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Beyond Cluster-Admin - Getting Started with Kubernetes Users and Permissions

Learn to implement users and permissions in Kubernetes clusters, covering user provisioning methods, RBAC for fine-grained access control, and strategies for both managed and self-hosted environments.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Demystifying Zero-Trust for Cloud Native Technologies

Explore zero-trust principles for cloud-native environments, covering identity, policy, continuous assessment, and security. Learn implementation guidelines for protecting users, devices, networks, applications, and data.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Cloud Native Security Landscape - Myths, Dragons, and Real Talk

Explore cloud-native security across the software lifecycle, from open-source creation to runtime threat detection. Learn about key projects, developer-security team collaboration, and separating real risks from myths.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Security as Code - A DevSecOps Approach

Explore DevSecOps and Security as Code with CodeQL. Learn to implement security checks, detect vulnerabilities, and foster collaboration between development and security teams for a robust security culture.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Software Supply Chain Security with TAG Security

Explore software supply chain security with insights on guidance, resources, and recent developments. Learn about the whitepaper, compromise catalog, and reference architecture for secure supply chains.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Zero Trust Workload Identity in Kubernetes

Explore Zero Trust principles in Kubernetes using SIFFE and Spire for workload identity-based authorization, eliminating the need for secrets and enhancing security across service meshes.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Improving Secure Pod-to-Pod Communication Within Kubernetes Using Trust Bundles

Explore advanced techniques for enhancing secure pod-to-pod communication in Kubernetes using trust bundles, leveraging cert-manager, SPIFFE, and KEP-3257 for automated TLS certificate creation and mTLS patterns.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

From Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native

Explore cryptojacking evolution in cloud environments, from basic attacks to sophisticated techniques targeting containers and Kubernetes. Learn proactive protection strategies using open-source tools for enhanced security.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Cloud Native Security 101 - Building Blocks, Patterns and Best Practices

Explore cloud native security fundamentals, attack vectors, and best practices for implementing continuous security in cloud applications without compromising innovation.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Security Does Not Need to Be Fun - Ignoring OWASP to Have a Terrible Time

Explore OWASP's free tools for web application security testing and implementation. Learn to identify issues early and integrate security best practices throughout the software development lifecycle.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Verifiable GitHub Actions with eBPF

Explore eBPF-based solution for securing GitHub Actions pipelines against supply chain attacks. Learn about runtime security, build profiling, and verification techniques to protect your software development process.

• YouTube
• 40 minutes
• Self-Paced
• Free Video