--- title: "Securing cloud workloads in 5 easy steps" source: "https://www.tigera.io/blog/securing-cloud-workloads-in-5-easy-steps/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Securing cloud workloads in 5 easy steps By [Senthil Nithiyananthan](https://www.tigera.io/blog/author/senthil-nithiyananthan/) on Jun 14, 2022 • 5 min read As organizations transition from monolithic services in traditional data centers to microservices architecture in a public cloud, security becomes a bottleneck and causes delays in achieving business goals. Traditional security paradigms based on perimeter-driven firewalls do not scale for communication between workloads within the cluster and 3rd-party APIs outside the cluster. The traditional paradigm also does not provide granular access controls to the workloads and [zero-trust architecture](https://www.tigera.io/learn/guides/zero-trust/zero-trust-architecture/), leaving cloud-native applications with a larger attack surface. Calico Cloud offers an easy 5-step process for fast-tracking your organization’s cloud-native application journey by making security a business enabler while mitigating risk. ## Step 1: Visibility Gaining visibility into workload-to-workload communication with all metadata context intact is one of the biggest challenges when it comes to deploying microservices. You can’t apply security controls to what you can’t see. The traffic is not just flowing from a client to a server in this new cloud native distributed architecture but also between namespaces that reside between many nodes, causing flow proliferation. With Calico Cloud, you get a dynamic visualization of all traffic flowing through your network in an easy-to-read UI. Example 1: You can view all the inside and outside (east-west and north-south) connections directly from Calico’s Dynamic Service and Threat graph. You can see in the image below that the private network is reaching out to the front-end of the storefront, and the frontend-external service is making east-to-west connections to other microservices (e.g., product catalog, shipping, etc.). You can also see that the checkout service is talking to the cart and payment microservices from the same page. ![Calico service graph showing private network connections to storefront frontend and external services](https://www.tigera.io/app/uploads/2022/06/image3-2.png) ***Read our [Tutorial](https://www.tigera.io/features/dynamic-service-graph/) for more information about Calico’s Dynamic Service and Threat graph*** Example 2: The Dynamic Service and Threat graph allows you to double-click into individual flows, where you can see namespaces making connections, destination service, port number, number of flows, permit or deny, and various other information, including process names and IDs. This essentially provides a tailor-made, live view of your cluster and highlights any vulnerabilities and security gaps. ![Table showing detailed network flow data: timestamps, namespaces, services, ports, and flow counts](https://www.tigera.io/app/uploads/2022/06/image4-1.png) ## Step 2: Security Policies After you see the security gaps, the next step is to build and apply **security policies** to have granular access control of the traffic flow in the environment. Calico Cloud provides a tier-based policy model with a high level of granularity for identity-aware [microsegmentation](https://www.tigera.io/learn/guides/microsegmentation/) (5-tuples and other identity-based elements like namespaces). Check out our website to learn more about [security policies](https://www.tigera.io/features/access-controls/). When you have more than a couple of microservices running in your environment, building security policies by hand can be a complex task. Calico Cloud offers a policy recommendation engine that you can use to build a base set of policies, and stage them to understand the impact of those security policies in your environment, thus automating the whole process of building security policies. The Security Policy Recommender can pull information for up to 24 hours and show you the granular recommendation per namespace. ![Calico Cloud's policy recommendation engine: Simplify complex microservice security policy creation](https://www.tigera.io/app/uploads/2022/06/image1-2.png) ![Screenshot of time range and namespace filter options](https://www.tigera.io/app/uploads/2022/06/image9.png) Once you have the recommendation engine build out the granular policy, you can stage the policy and preview the flows that will be affected. A sample screenshot of all the frontend flows that will be affected is shown below. ![Screenshot showing frontend flows impacted by a new policy, comparing current and projected traffic](https://www.tigera.io/app/uploads/2022/06/image5-1.png) ***Read more about Calico’s [Security Policy Recommender](https://www.tigera.io/features/network-threat-detection/)*** ## Step 3: Advanced Security Controls Building a zero-trust architecture means having **advanced security controls** enabled as part of the architecture to identify zero-day threats in the environment. Here are a few examples of features that Calico Cloud offers today. - FEODO tracker – Calico’s FEODO tracker lists all the command and control IP addresses in the cluster. You can automatically block those connections from going out of the pods (see below screenshot). - Honeypods – Security admins can see if any suspicious connections exist in the environment by creating honeypods to check if any connections are being made to a pod. - Data-in-transit encryption – Easily encrypt all traffic between pods using WireGuard, and avoid performance issues that come with TL - Runtime threat defense – Calico Cloud provides an easy way to turn on advanced security features like [workload-based IDS/IPS , anomaly detection, and WAF](https://www.tigera.io/features/workload-based-ids-ips-ddos-dpi-waf/). ## Step 4: Troubleshooting One of the challenges that the security team is always battling with ephemeral services is that issues don’t last long enough to **troubleshoot**. The Dynamic Packet capture capability in Calico Cloud provides an easy way to schedule the capture and download packet captures (pcap files) so you can identify and fix any issues in the environment. ***Learn more about [Dynamic Packet Capture](https://www.tigera.io/features/packet-capture/)*** ![Screenshot showing menu option "Initiate packet capture" within a network visualization; learn more](https://www.tigera.io/app/uploads/2022/06/image10.png) ![Screenshot of Dynamic Packet Capture configuration form, showing fields for job name, namespace, time range, protocol, and](https://www.tigera.io/app/uploads/2022/06/image7-1.png) ## Step 5: Compliance Reporting Calico Cloud **compliance reporting** provides an easy way to keep track of nodes and namespaces that are protected by ingress and egress rules. Organizations can easily download and share these with the compliance team to fast-track their cloud migrations. Organizations can also easily run benchmark reports against CIS standards for Kubernetes. ***Learn more about Calico’s [compliance and audit](https://www.tigera.io/features/compliance-and-audit/) features.*** ![Calico compliance: Charts showing 100% protection of egress and ingress namespaces and endpoints](https://www.tigera.io/app/uploads/2022/06/image8.png) ![Kubernetes CIS benchmark results showing Calico's compliance test pass/fail rates](https://www.tigera.io/app/uploads/2022/06/image2-2.png) Calico Cloud provides a lot of security features above and beyond what is listed here, but the goal of this post is to get you started on your Kubernetes journey so you have peace of mind around enabling security for workloads. This is not a comprehensive list of features that you will need, but is a great first step in applying security and moving from DevOps to [DevSecOps](https://www.tigera.io/learn/guides/devsecops/) on day 0. This will help you reduce time to deployment for your applications in a multi-cloud architecture. **Note**: The above 5 steps can be easily tested with any Kubernetes cluster and Google’s [Hipster Shop](https://github.com/googlecloudplatform/microservices-demo) demo scripts. Try these features for yourself by signing up for a [free trial of Calico Cloud](http://calicocloud.io). [How-To](https://www.tigera.io/tags/how-to/)[Products](https://www.tigera.io/tags/products/) ## Related posts [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) [![AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/app/uploads/2026/08/AI-Red-Team-Agents-Automate-Attacks-on-your-AI-Agents.-Runtime-Policies-Automate-their-Defense.png)](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) #### [AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 24, 2026 The AI red teaming market grew up fast this year. OpenAI bought Promptfoo, Cisco and Microsoft shipped automated attack suites, and a seed-stage startup publicly compromised 50 of 55 live customer service bots. These platforms... [Read more](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/)