Column: System security
Cloud native security and the security posture of cloud resources
By Hector Tejero, Solutions Architect, Arrow Electronics C
loud computing offers significant benefits, among them scaleability, flexibility and agility. However, the dynamic and distributed nature of cloud
native architectures create unique challenges that require risk management. Managing the security posture of cloud resources and services regardless of their location or network boundaries is a key aspect of cloud computing. Te practices, tools and strategies used to secure applications and data in cloud native environments are cumulatively known as “cloud native security”. Tese applications are typically built using containers, microservices and platforms like Kubernetes.
Cloud security Some aspects of cloud-native security include: • Infrastructure security Cloud native applications rely on underlying cloud infrastructure provided by cloud service providers. It is essential to configure and secure cloud resources properly, including virtual networks, storage and databases. Implementing strong identity and access management (IAM) controls and encryption is crucial. An emerging trend in cloud security includes the centralised management of cloud IAM policies.
• Secure application development Building security into the application development lifecycle from the outset is central to cloud-native security. Tis includes implementing secure coding practices, performing code reviews and adopting secure development frameworks. Zero Trust is a security concept and framework that assumes no implicit trust for users, devices or networks, both within and outside the
organisation’s network perimeter. It requires verifying every user and device attempting to access resources, regardless of their location or network context. By adopting a Zero Trust approach, organisations can enhance their security posture, reduce the risk of data breaches and insider threats, and protect critical assets and data. • Microservices security Cloud native applications oſten comprise multiple microservices. Securing microservices involves implementing strong authentication and authorisation mechanisms, encrypting communication between services, and monitoring for potential security breaches. • DevSecOps integration Te DevSecOps approach promotes collaboration between development, security and operations teams. Security is integrated throughout the development and deployment pipeline with automated security testing, vulnerability scanning and code analysis tools. • Container security Containers are isolated, lightweight units used to package and deploy applications. Container security involves scanning images for vulnerabilities using secure base images, regularly updating containers and enforcing access control between them. • Orchestration platform security Orchestration platforms like Kubernetes manage the deployment and scaling of containerised applications. Tese platforms are secured by implementing access controls, enabling auditing and logging, securing the Kubernetes API and regularly applying security patches. Security Orchestration, Automation and Response (SOAR) is a cybersecurity approach that improves the
14 July/August 2023
www.electronicsworld.com
efficiency and effectiveness of security operations by reducing response times, improving operational efficiency and enabling better collaboration among security teams. By automating and orchestrating security tasks, organisations can respond to threats faster, minimise the impact of security incidents and better use their security resources. • Compliance and governance Cloud native security ensures adherence to relevant compliance regulations and industry standards. It involves implementing security controls, conducting security assessments and maintaining proper documentation to meet compliance requirements. • Continuous security monitoring Te practice of continuously monitoring and managing the security configuration and compliance of cloud resources and services is referred to as Cloud Security Posture Management (CSPM). It plays a crucial role in securing cloud environments by proactively identifying and addressing security risks arising from misconfigurations and compliance gaps. By applying CSPM solutions, organisations can maintain a strong security posture, reduce the attack surface and enhance the protection of their cloud assets and data.
Shared responsibility Te security posture of cloud resources is a shared responsibility between the cloud provider and the customer. Whilst security is crucial in cloud computing, it is just one component of a comprehensive cloud strategy. Organisations must also consider factors like data privacy, compliance, data backup and recovery, and overall system performance.
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60
