Technical insights and best practices for Security & Compliance
Trivy exits 0 even with CRITICAL findings. I built it from source and made it a real CI gate, then found a secret-scan skip that a green result can hide.
Enforce CIS network sysctl baselines with Ansible, gate deployments on OpenSCAP results, and reject Ingress objects without TLS using an OPA admission policy.
Run containers as non-root, with a read-only filesystem, dropped capabilities and a default-deny NetworkPolicy, so one compromised app has little to work with.
Replace trust-by-network-location with encrypted, authenticated links: WireGuard between nodes, nginx client certificates and hardened SSH with a second factor.
What the Schrems II ruling changed, why a region label is not compliance, and how LUKS, MariaDB encryption, TLS 1.3 and WireGuard reduce exposure in 2020.