Overview of Cloud Native Security (14%)

4Cs of Cloud Native Security

1. Code: Secure development practices (e.g., avoid hardcoding secrets).
2. Container: Prevent privilege escalation, use minimal base images.
3. Cluster: Restrict API server access, encrypt etcd data.
4. Cloud: Use cloud-native tools for monitoring and securing infrastructure.

Cluster Security

• Harden the Kubernetes API server with role-based access control (RBAC).
• Disable anonymous authentication for kubelet communication.

Pod Security

• Use Pod Security Admission (PSA) to enforce best practices (e.g., no root users).
• Isolate sensitive workloads using namespaces and network policies.

Code Security

• Use static code analysis tools like SonarQube or Codacy.
• Store secrets securely using Kubernetes Secrets.

Kubernetes Threat Models

Attack Vectors

• Privilege Escalation: Exploiting weak RBAC configurations.
• Unauthorized Access: Using misconfigured service accounts.
• Data Theft: Exploiting unencrypted volumes or exposed secrets.

Mitigations

• Apply principle of least privilege with RBAC.
• Use encryption for both data at rest and in transit.
• Regularly scan images for vulnerabilities.

Platform Security

Supply Chain Security

• Use SBOMs (Software Bill of Materials) to track dependencies.
• Sign container images using tools like Cosign.

Artifact and Image Security

• Enforce vulnerability scanning with tools like Trivy or Clair.
• Ensure images come from trusted registries.

Policy Enforcement

• Use tools like Kyverno and OPA Gatekeeper to validate deployments.
• Enforce policies for image signatures, namespace isolation, and resource quotas.

Compliance Frameworks

GDPR

• Encrypt sensitive user data in transit and at rest.
• Implement RBAC to restrict access to personal data.

HIPAA

• Ensure secure handling of healthcare information using TLS and encrypted storage.
• Log and monitor access to healthcare data.

PCI DSS

• Segment payment data workloads with network policies.
• Regularly audit access controls and encryption compliance.

CIS Benchmarks

• Use kube-bench to check Kubernetes against CIS recommendations.
• Ensure secure API server and etcd configurations.

Threat Modeling

STRIDE Framework

• Spoofing: Prevent by enforcing strong authentication (e.g., mTLS).
• Tampering: Ensure data integrity with digital signatures.
• Information Disclosure: Encrypt all sensitive data.
• Denial of Service: Use resource quotas and rate limits.

MITRE ATT&CK Framework

• Focuses on real-world attack scenarios.
• Categories include Initial Access, Persistence, Privilege Escalation, and Defense Evasion.

Observability and Incident Response

Monitoring and Logging

• Use Prometheus for metrics collection and alerting.
• Use Fluentd or Elasticsearch for log aggregation and search.

Incident Investigation Tools

• Use Falco for runtime security alerts.
• Use Zeek and Snort for network intrusion detection.