DevSecOps › Module 8 › Lesson 1
Runtime Named
Runtime security literacy — admission control, read-only rootfs, network policy stub, runtime threat detection, least-privilege service account — named rows on YOUR `$DEVSEC_LAB` deploy stubs.
Visual · t36_runtime_named
Runtime = named deploy guard rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Build-time scans miss runtime drift — name admission control and network policy rows on YOUR lab deploy stubs before tampering with stranger org clusters.
Runtime named literacy names: admission control policy category (OPA/Gatekeeper literacy stub), read-only root filesystem category, network policy stub category, runtime threat detection category (Falco literacy stub), and least-privilege service account category. Analyst documents runtime guard card on `$DEVSEC_LAB` lab deploy manifest — five rows with pass/fail literacy — without modifying stranger org Kubernetes clusters, without deploying crypto-miners as 'runtime test,' without bypassing admission control on prod without ticket. Cyberlium teaches runtime vocabulary on YOUR notes — defender deploy literacy. Refused: stranger cluster tampering, malicious runtime payloads, unauthorized prod deploy. Lab row: runtime guard card (five rows, manifest link, pass/fail stub).
1. Named runtime rows
Admission control, read-only rootfs, network policy, runtime detection, service account — five literacy anchors.
Each row cites YOUR lab manifest — not generic K8s hardening blog.
Command guide
Try these commands — Named runtime rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF PS.2 — https://csrc.nist.gov/Projects/ssdf CISA SBOM — https://www.cisa.gov/sbom CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://www.cisa.gov/sbom | head -10
cat > "$DEVSEC_LAB/notes/sbom-named.txt" <<'EOF'
SBOM — Software Bill of Materials — NAMED LITERACY:
Purpose: inventory of components, versions, licenses, dependencies
Formats: SPDX, CycloneDX
Use: vuln response (log4shell-style), license compliance, supply chain
Tool: syft packages DIR -o cyclonedx-json (optional in lab)
SSDF PS.2: verify release integrity — SBOM + signing
Lab: sbom/checklist.md if syft not installed — YOUR repo only
EOFCommand — copy this
grep -E 'SPDX|CycloneDX|syft|YOUR' "$DEVSEC_LAB/notes/sbom-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); CISA SBOM (https://www.cisa.gov/sbom); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Build vs runtime split
Module 7 scans at build — runtime guards catch drift and live threats.
Link Module 7 CI gate — complementary not duplicate literacy.
3. Refused
No stranger cluster modifications; no malicious runtime payloads; no prod bypass without ticket.
Runtime literacy supports YOUR deploy hygiene — not cluster sabotage.
4. What you ship: runtime guard card
Five runtime rows + manifest link + pass/fail stub + NEVER stranger cluster tamper line.
5. What you record before the next lesson
Runtime guard card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy test crypto-miner pod on stranger org leaked kubeconfig as 'runtime detection research.'
Right
Runtime guard card from `$DEVSEC_LAB` deploy stub. Next: SBOM Named.
Mission: runtime guard card
1) Name five runtime literacy rows. 2) Map each to lab manifest stub. 3) Pass/fail criteria per row. 4) Write NEVER stranger cluster tamper line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Admission control vs network policy — literacy split?”
Knowledge Check
APPLY: Runtime literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger cluster modifications are course lab.
True or False
Knowledge Check
APPLY: Runtime guard card includes:
Multiple choice