DevSecOps Practice Hub

Network Security

Segment workloads, default-deny traffic and encrypt communication in transit.

IntermediateNetwork SecurityInfrastructureCloudContainer

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

Segmentation limits lateral movement. In clusters this means NetworkPolicy and mTLS; in cloud it means tightly scoped security groups and private subnets with controlled egress.

Why it matters

Flat networks turn a single compromised workload into estate-wide access.

How it works

  1. 01Default-deny both ingress and egress, then allow explicitly.
  2. 02Enforce mTLS between services where a mesh is in use.
  3. 03Route egress through controlled gateways with logging.

Common tools

CiliumIstioAWS Security GroupsKubernetesAWSAzureLinux

Implementation examples

yamlRestrict egress to a database
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: api-egressspec:  podSelector:    matchLabels: { app: api }  policyTypes: [Egress]  egress:    - to:        - podSelector:            matchLabels: { app: postgres }      ports:        - port: 5432
Remember to allow DNS egress separately or name resolution will fail.

Best practices

  • Default-deny egress, not just ingress.
  • Log denied flows to detect misconfiguration and probing.

Common mistakes

  • Forgetting DNS when introducing egress policy.