Contactez-nous
  • Génie logiciel

Cloud-native Infrastructure Security

Mis à jour le

Responsable(s) : M. Stefano SECCI

  • Cours + travaux pratiques
Code Cnam : USEEN1
Téléchargez le PDF

Envie d'en savoir plus sur cette formation ?

Afin d’obtenir les tarifs, le calendrier de la formation, en distanciel, en présentiel, le lieu de la formation et un contact, remplissez les critères suivants :

Afficher le centre adapté à mes besoins

Afin d’obtenir les tarifs, le calendrier de la formation et le lieu de la formation, remplissez les critères suivants :

  • Durée : 50 heures (+/- 10%)
  • Package
  • 6 crédits

Présentation

Public, conditions d'accès et prérequis

Prérequis

PrerequisiteExpected level
LinuxBasic command-line use, file system concepts, processes, and familiarity with the Linux environment.
NetworkingBasic understanding of IP addressing, ports, routing, client/server communication, and firewalls.
SecurityGeneral cybersecurity concepts such as authentication, authorization, vulnerabilities, and attack surfaces.
Git and version controlBasic Git commands, repositories, commits, branches, and collaboration workflows.

The course materials state that these are expected prerequisites, while also noting that the basics are reviewed during the course.

For the labs, students should have access to a machine capable of running Docker and local Kubernetes tooling. Lab 1 requires Docker, preferably installed in rootless mode, and Lab 2 uses Minikube with a suggested Docker driver on macOS/Linux and Hyper-V on Windows.

Objectifs

Students who take this course will gain an understanding of the concepts and theories of computer-aided formal specification and verification, and learn how to use and write formal verification tools.

L'avis des auditeurs

Les dernières réponses à l'enquête d'appréciation pour cet enseignement : Fiche synthétique au format PDF

Compétences et débouchés

Compétences

By the end of the course, students will have developed a structured understanding of cloud-native application security and software supply chain security. They will be able to deploy and analyze containerized applications, use Docker and Kubernetes, identify the main risks affecting container images, registries, dependencies, CI/CD pipelines, and runtime environments, and propose appropriate mitigation strategies. Students will also be able to integrate security controls into DevSecOps workflows, use monitoring and observability tools, and reason about realistic attack and defense scenarios in cloud infrastructures.

Parcours

Programme

Contenu

This course introduces the principles, tools, and practices required to secure modern cloud-native applications across the full software supply chain. It follows the lifecycle of a cloud application from source code and dependencies to build, distribution, deployment, runtime, monitoring, and incident-oriented use cases. The central objective is to understand how contemporary cloud-native systems are built and how each stage of their lifecycle can be secured.

The course combines lectures and practical labs. Students work with containerized applications, Docker, Kubernetes, CI/CD pipelines, GitLab-based workflows, security scanning, Kubernetes security mechanisms, runtime monitoring, and realistic cloud-security use cases. The labs are designed both as tutorials for cloud technologies and as practical exercises requiring students to solve security-oriented tasks and submit written answers.

A recurring case study, CICDiaries, is used to illustrate secure CI/CD workflows and software-supply-chain risks in a realistic development and deployment environment.

Course content

1. Introduction to cloud and software supply chain security

The course begins with the cloud model, public/private/hybrid cloud, IaaS/PaaS/SaaS, regions and availability zones, virtualization, the shared-responsibility model, and the relationship between cloud environments and software supply chains. It also introduces major supply-chain incidents such as SolarWinds and Log4Shell as motivating examples.

2. Cloud virtualization stack and containers

Students review Linux as a foundation for cloud systems, including kernel/user space, Linux networking, iptables, eBPF, virtual machines, hypervisors, and containers. The associated lab introduces Docker, image discovery, container execution modes, Dockerfiles, image building, and container networking.

3. Kubernetes and orchestration

The course covers microservice architectures, container orchestration, Kubernetes concepts, and Kubernetes networking. Students use Minikube to create a local Kubernetes cluster and explore Kubernetes resources and network behavior.

4. Kubernetes security

This part addresses container and Kubernetes security best practices, Kubernetes networking security, RBAC, seccomp, AppArmor, and the security implications of shared kernels and container isolation.

5. Software supply chain and CI/CD security

Students study direct and indirect adversary models against containers, host systems, Docker daemons, networks, repositories, and image ecosystems. Practical activities include Git, GitLab, merge requests, signed and verified commits, and security controls around CI/CD workflows.

6. Runtime monitoring and detection

The course introduces the distinction between prevention and detection in Kubernetes environments. Topics include metrics, alerts, kube-state-metrics, Metrics Server, Prometheus, Grafana, and Jaeger for monitoring microservice-based systems.

7. Practical testbed and use cases

The final part applies the previous concepts to a practical Kubernetes testbed, including Vagrant, Ansible, multi-node clusters, namespaces, isolated environments, and realistic cloud-security scenarios.

References

Kubernetes. (n.d.). Security concepts. Kubernetes Documentation. https://kubernetes.io/docs/concepts/security/

Kubernetes. (n.d.). Pod security standards. Kubernetes Documentation. https://kubernetes.io/docs/concepts/security/pod-security-standards/

National Institute of Standards and Technology. (2019). Security strategies for microservices-based application systems(NIST Special Publication 800-204). https://csrc.nist.gov/pubs/sp/800/204/final

National Institute of Standards and Technology. (2022). Implementation of DevSecOps for a microservices-based application with service mesh (NIST Special Publication 800-204C). https://csrc.nist.gov/pubs/sp/800/204/c/final

Open Source Security Foundation. (n.d.). Supply-chain Levels for Software Artifacts. https://openssf.org/projects/slsa/

OWASP Foundation. (n.d.). Software Component Verification Standard. https://owasp.org/www-project-software-component-verification-standard/

SLSA. (n.d.). Supply-chain Levels for Software Artifacts. https://slsa.dev/

Modalités d'évaluation

The evaluation combines continuous practical assessment and a final exam.

Lab deadlines are announced after publication, typically around one week after the lab is released. Some labs are tutorials, while others are graded exercises requiring students to solve tasks and submit answers.

Ces formations pourraient vous intéresser