Tools Alone Won't Suffice: Building Systemic Kubernetes Security Across Hundreds of Clusters at Alfa-Bank

Alfa-Bank has operated Kubernetes clusters for more than ten years and reports that over 53 percent of Russian companies now use vanilla Kubernetes, yet security outcomes remain poor. According to the Red Hat “State of Kubernetes Security 2024” report, 46 percent of organizations suffered financial losses due to insufficient Kubernetes security, and nine out of ten experienced at least one container or Kubernetes-related incident.

Alexander, lead of the K8S and cloud security department, argues that the root cause is not a lack of tools—more than 100 security products exist—but the absence of a systemic process framework. Before the bank adopted such a framework, requirements, incidents, and audits existed in isolation, and teams had no accurate inventory of clusters or their configurations.

Process Map Built Around the Threat Lifecycle

The bank groups its processes into a pipeline that follows the threat lifecycle: detect, prevent, verify, control, and respond. Every process begins with threat modeling that feeds into security requirements, which are then communicated to delivery teams, validated through reviews and audits, and supported by runtime monitoring and incident response. The resulting map closely resembles classic security operations workflows rather than Kubernetes-specific tooling checklists.

Responsibility for each step is defined using a RACI matrix that distinguishes Responsible, Accountable, Consulted, and Informed parties. This matrix is applied across domains because cluster security depends on node security, business workload security depends on the cluster, and vice versa.

Key Process Areas

• Threat modeling draws on commercial feeds, public research, and internal intelligence; the security team owns the model and maps scenarios to requirements.
• Requirements are translated into architecture patterns for single-tenant and multi-tenant clusters, plus scripts, playbooks, and audit policies developed jointly with DevOps teams.
• Project expertise is coordinated by AppSec Business Partners who route relevant projects to the Kubernetes security team for validation against patterns and specifications.
• Audits combine automated and manual detection of misconfigurations, contextual validation with delivery teams, remediation tracking against SLAs, and two-stage inventory covering both clusters and their internal objects.
• Risk assessment serves as the final control when technical mitigation is impossible; the Kubernetes team contributes mitigation descriptions and risk scenarios.
• Platform operations run on four dedicated clusters managed entirely by the security team.
• SOC integration supplies log-collection policies, detection signatures, and playbooks while the SOC team leads primary incident response.

Competency Model and Staffing

Four roles cover the required breadth of skills: Architect (sets foundational decisions), Analyst/Engineer (implements and operates processes), Auditor (drives the full audit lifecycle and tooling), and Platform DevOps Engineer (maintains observability and platform stability). With more than 500 clusters ranging from six to over 300 nodes, the bank determined that these four specialized positions are the minimum needed to sustain the system.