<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-network-policies
description: >-
  Implement Kubernetes NetworkPolicies for micro-segmentation, default-deny posture,
  egress filtering, and DNS-based policies using Calico, Cilium, and native K8s
  network policy resources to restrict lateral movement and data exfiltration.
domain: cybersecurity
subdomain: container-security
tags:
  - network-policy
  - calico
  - cilium
  - micro-segmentation
  - lateral-movement
  - egress-filtering
  - kubernetes
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.004"]
---

# Implementing Network Policies

## Overview

Kubernetes NetworkPolicies enforce micro-segmentation at the pod level, controlling
ingress and egress traffic based on pod labels, namespace selectors, and CIDR blocks.
This skill covers designing default-deny policies, implementing least-privilege
network access, configuring DNS-based egress filtering with Calico and Cilium,
and auditing existing policies for gaps that enable lateral movement.

Mode: `[MODE: ARCHITECT]` — Security architecture with `[MODE: BLUE]` verification.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster with a CNI that supports NetworkPolicy (Calico, Cilium, Weave) | Required |
| `kubectl` with permissions to create NetworkPolicy resources | Required |
| `calicoctl` or `cilium` CLI for advanced policies | Required |
| Network policy editor/visualizer (optional: Cilium Editor) | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/implementing-network-policies-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/implementing-network-policies-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/implementing-network-policies-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Network Policies Detection
id: 45922f70-02e7-4ac2-b6cf-4685debefaf0
status: experimental
description: Detects suspicious activity related to implementing network policies techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1562.004
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Policies Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562.004 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [Calico Network Policy](https://docs.tigera.io/calico/latest/network-policy/)
- [Cilium Network Policy](https://docs.cilium.io/en/latest/security/policy/)
