KUBICAST #188 - More than cloud security

With Leandro Venâncio

Cloud security is not a box that we just turn on: it is a set of daily decisions — technical, cultural, and procedural — which, when well-orchestrated, reduce risk without hindering the team.

In this episode of Kubicast, we welcome Leandro Venâncio to unpack how to go beyond the "compliance checklist" and build a security program that matches the pace of the product. We talk about identity and networking, Kubernetes policies, built-in security pipelines, and, of course, how to prioritize what really matters when alerts keep coming. Below, we condense the best ideas from the talk into a practical guide.

Why “more than” cloud security?

Because cloud by itself does not solve security; it changes the responsibility model. Providers take care of the hardware and part of the software, but configuration, identity, data, and applications remain ours. And when we bring Kubernetes to the center of the architecture, we multiply the attack surface and the speed of change. The result: security is no longer just a tool and becomes an operational discipline.

Three pillars that sustain the rest

1. Identity first
   It all starts with who can do what. In the cloud control plane, use dedicated accounts/roles, least privilege, and credential rotation. In the cluster, align RBAC with actual responsibilities and apply service accounts per workload (no omnipotent default!).

2. Lean and intentional network
   Segmenting is cheap in the cloud. Combine well-thought-out VPCs/VNets, NetworkPolicies in K8s, and, when it makes sense, a service mesh for mTLS and authorization between resources. Public exposure only when unavoidable — and always behind gateways and WAF.

3. Encryption and secrets under control
   Keys in KMS and secrets managed by External Secrets or equivalent. No ConfigMaps with passwords. In transit, TLS by default; at rest, keys per environment with regular rotation.

From “shift left” to “shift right” (without losing the middle)

We usually love shift left, but the episode makes it clear: without a mature operation, it is half a solution. A healthy workflow is:

• Code: SAST + human review focused on probable threats.

• Build: SCA for dependencies, creating an SBOM, and image signing.

• Deploy: Admission controllers (Kyverno/Gatekeeper) to prevent what should not exist — privileged, hostPath, latest, no resource limits, etc.

• Run: Useful telemetry (logs, metrics, traces), runtime policies, and a tested incident response.

This sequence creates short and measurable feedback loops.

CNAPP, CSPM, “acronyms” and what to use when

• CSPM shows insecure configurations in the provider. Great for prioritizing backlogs and measuring account hygiene.

• KSPM/Kubernetes posture focuses on the cluster (RBAC, policies, versions, workloads).

• CNAPP stitches together a risk view from code to runtime (dependencies, images, permissions, exposure).

The secret is to orchestrate signals: use the tool to prioritize and automation to remediate (IaC, policies as code). Dashboards with no owner do not trigger merge requests.

Security-oriented observability

Logging everything is easy; finding what matters is the art. In this episode, we advocate for:

• Control metrics (how many deploys blocked by policy? how many secrets rotated?).

• Traces to catch lateral movement and latency anomalies.

• Alerts with actionable context: who, what, where, with which commit and which owner.

Create short playbooks and test them (security chaos game). Nothing replaces a dry run of an incident.

30/60/90 Day Checklist

In 30 days

• Map accounts, roles, and access. Remove zombie permissions.

• Enable a baseline of NetworkPolicies.

• Introduce Kyverno/Gatekeeper in audit mode.

• Manage secrets via KMS + External Secrets.

In 60 days

• Sign images and require digests in production.

• Pipeline with SCA, SBOM, and vuln gates tailored to risk.

• Enforce critical policies (privileged, hostPath, no-limits).

• Minimum security metrics and alerts.

In 90 days

• Inventory exposed surfaces (ingress/WAF) and reduce attack surface.

• Incident response exercise with internal public postmortem.

• Integration of CSPM/CNAPP into the IaC backlog (auto-remediation where it makes sense).

Questions that help prioritize

1. If a token leaks today, can we revoke and rotate it in minutes?

2. What is the least permission in production that a pipeline needs to deploy?

3. Can we prove that every image in production came from our build chain?

4. Which alerts wake us up in the middle of the night — and why?

5. What is acceptable to break if we tighten a policy right now?

Key takeaways from the episode

• Effective security is well-placed friction.

• Simple, visible, and automated policies pay off the investment faster.

• Shift left without shift operate becomes theater; we need the complete cycle.

• A good metric is one that reduces risk or accelerates the team — the rest is noise.

• Leandro Venâncio - https://www.linkedin.com/in/leandro-venancio/

• LowOps cast with Rafael Ferreira - https://www.youtube.com/live/SC6a11HClX4

• João Brito - https://www.linkedin.com/in/juniorjbn/

• Watch the movie TEArapia - https://youtu.be/M4QFmW_HZh0?si=HIXBDWZJ8yPbpflM

  
  

This article is an expanded summary of Kubicast #188 — More than cloud security, featuring Leandro Venâncio. Listen to the full episode for real-life examples and field stories that don't fit here -> Spotify 🎧