Week 6: Cloud-Native Security (DevSecOps) (Days 36-42)
What We Are Building
SecureStack is a production-style security control plane: one FastAPI backend, one Command Center dashboard, and optional Docker packaging. It unifies capabilities that mature platform teams normally operate as separate tools—because breaches happen in the gaps between them, not inside any single product.
You will authenticate with JWT claims, block vulnerable images at admission, rotate encrypted secrets with audit trails, run real static analysis against source trees, score runtime threats with automated containment, generate CycloneDX SBOMs with attestations, and run a full posture assessment that rolls up compliance signals.
Scope for This Build
Identity and policy evaluation (OIDC-style JWT, OPA decisions, network segmentation model)
Workload security (image CVE analysis, admission gates, runtime alerts, CIS-style benchmark)
Secrets and PKI (encrypted vault paths, rotation, cluster sync semantics, certificate issuance)
Vulnerability pipeline (SAST, container and dynamic scans, remediation lifecycle)
Incident automation (threat scoring, SOC-style response, live event feed)
Supply-chain integrity (SBOM generation, signing, verification)
Posture assessment (cross-domain validation and compliance rollup)
Success criteria: Command Center shows live metrics per security domain; API health returns all capability groups; a vulnerable image is rejected at admission; full assessment returns a score with framework flags; Prometheus
/metricsexposes control-plane RED signals after traffic.
Core Concepts
Security as a Platform Capability
DevSecOps is not a late-stage review—it is how release engineering and infrastructure engineering embed controls into delivery. SecOps owns detection and response; platform engineering owns the shared APIs and policies; SRE ties posture to reliability budgets.
