375 BROUGHT TO YOU IN PARTNERSHIP WITH

Cloud-Native CONTENTS

•  Key Challenges With Cloud-Native

Application Security

Application Security •  Injecting Security Into DevOps

•  Cloud-Native Security Patterns

and Anti-Patterns

Patterns and Anti-Patterns •  Shared Responsibility Model

for Security

•  OWASP Framework

•  Conclusion

SAMIR BEHARA
SENIOR CLOUD INFRASTRUCTURE ARCHITECT, AWS

Enterprises are rapidly adopting cloud-native architectures and design LACK OF SECURITY MINDSET
patterns to help deliver business values faster, improve user experience, When development teams build products, their primary focus areas
maintain a faster pace of innovation, and ensure high availability are functionality and usability. Faster release cycles make it difficult
and scalability of their products. Cloud-native applications leverage to inspect and resolve security vulnerabilities correctly. In addition,
modern practices like microservices architecture, containerization, development teams do not always have the required skill set to identify
DevOps, infrastructure-as-code, and automated CI/CD processes. security issues and, at the same time, do not want to be slowed down
by unknown security concerns.
Cloud-native application security is a cloud-first approach used to
deploy applications securely at scale by embedding security into As a result, security often takes a back seat. However, it would be best
the software development lifecycle to detect vulnerabilities earlier. to consider security an integral part of the DevOps pipeline amidst the
This Refcard will walk through the critical challenges of cloud-native need to deliver high-quality software in a cloud-native landscape.
application security, demonstrate how to build security into the CI/CD
PEOPLE AND CHANGE
pipeline, and introduce the core patterns and anti-patterns of cloud-
One of the biggest challenges with enterprise transformations is not
native security.
the underlying technology but the non-technical aspects of handling

KEY CHALLENGES WITH CLOUD-NATIVE the change. Some common barriers to cloud adoption are the changes

APPLICATION SECURITY
Cloud-native architectures bring in challenges related to application
and infrastructure security. Let us look at a few of the most prominent
challenges organizations face related to cloud-native security.

TRADITIONAL SECURITY vs. CLOUD-NATIVE

SECURITY: A PARADIGM SHIFT
Traditional security tooling is built for static environments and is
ineffective in the dynamic and rapidly changing cloud-native landscape.
Furthermore, with the advent of microservices, containers, service
meshes, and multi-cloud environments, it has become increasingly
difficult for organizations to track software vulnerabilities. As a result,
there is an increased dependency on automation and continuous
monitoring throughout the application lifecycle.

© DZONE | REFCARD | OCTOBER 2023 1

 REFCARD | CLOUD-NATIVE APPLICATION SECURIT Y

in people, operating models, governance, business practices, and the environments. This requires your development teams to work closely
fast pace of innovation. Organizations need a structured approach with the security team. As a best practice, you should have guardrails in
to cloud adoption that includes aligning leaders, mobilizing teams, place, which can disallow actions that lead to policy violations.
and engaging the entire organization. There needs to be alignment
LACK OF AUTOMATED COMPLIANCE CHECKS
between IT and business leaders to lead the organizational journey and AND ENFORCEMENT
drive cultural change — as well as a focus on developing and creating a Enterprises need a framework of controls to meet their compliance
learning plan to upskill people. needs and manage risks effectively. There are several security
standards and compliance certifications like HIPAA, FedRAMP, NIST
SOFTWARE DEPENDENCY PROBLEM
800-171, and PCI that customers need to satisfy their requirements.
By adding reusable external dependencies in the codebase, developers
While architecting and deploying workloads in the cloud, you must
can leverage complex functionalities without developing and
ensure compliance with each workload and consider the unique
maintaining them. However, open-source libraries are susceptible
requirements from a security standpoint. You also want to validate
to being compromised, causing security issues in your application.
that the services operate securely in a production environment. Finally,
Therefore, you must do your due diligence to ensure that software
you need to continuously monitor and assess the security controls to
dependencies are inspected for malware and vulnerabilities.
ensure strict adherence to compliance regimes.
SELECTING THE RIGHT REAL-TIME
VISIBILITY TOOLS AUTOMATION AND PRIORITIZATION OF ALERTS

Security in the cloud brings a new set of challenges that your Amidst the increasing number of breaches and cyber threats, you must

organization might not be trained to handle. Hence, it's imperative that ensure that your alarms are fine-tuned. Having to deal with redundant

you evaluate and finalize the right tools to secure your applications in alarms can cause alert fatigue. In addition, if you get an overwhelming

a cloud-native world. With containers spinning up and down within number of alerts with false positives, there is a high chance of

seconds, you need tools to provide real-time visibility into your missing out on critical alerts. Therefore, while designing cloud-native

containerized environments. The attack surface in the cloud is rapidly applications, it is crucial that you have automation in place to similarly

increasing, and there are numerous cases of data breaches, compliance aggregate alerts and visualize the severity of such alerts.

issues, and compromised APIs. From a security standpoint, having

INJECTING SECURITY INTO DEVOPS
complete observability of your workloads by leveraging the right tools
Having DevOps processes in place improves efficiency, reduces
for logging, metrics, traces, and alerting is critical.
failures, implements faster deployment cycles, enhances application
ENFORCING CONSISTENT SECURITY POLICIES performance, and provides better customer experience. Taking a
AND GUARDRAILS step further, DevSecOps can be defined as a practice to deliver secure
Today, enterprises leverage third-party security tooling and software through a continuous delivery model. Therefore, security
managed services provided by their public cloud provider to build should be considered an integral part of your CI/CD pipeline, as seen
their cloud security posture. However, it is challenging to develop in Figure 1. Teams need to ensure that it is built into the application
centralized policies and guardrails that apply across your cloud-native lifecycle phases in an iterative and automated manner.

Figure 1: Building security into the DevOps pipeline

Image source: "Securing Cloud-Native Applications"

© DZONE | REFCARD | OCTOBER 2023 3 BROUGHT TO YOU IN PARTNERSHIP WITH

 REFCARD | CLOUD-NATIVE APPLICATION SECURIT Y

SHIFT-LEFT SECURITY STRATEGY Security hotspots are sensitive pieces of code to be reviewed during
The velocity and frequency of feature deployment has increased the code review process. However, when a security vulnerability is
tremendously in this cloud-native world. A single security team in an detected, it might have a broader impact on your application and
organization cannot be entirely responsible for the security of all your need to be fixed immediately. As part of the CI/CD pipeline, every code
applications in the cloud. Bridging the gap between development, change will get scanned by these security rules and flagged if there are
operations, and security teams is critical to deploying secure outliers. You can fail your quality gates, as seen in Figure 2, when the
applications. Building security controls into all your pipeline stages security standards are not met.
would be best to shift security left.
Figure 2: SonarQube Quality Gate
Fixing security issues in production is expensive; hence, incorporating
security practices during the development phase is highly
recommended. Shifting left requires collaboration and engagement
between teams during the early stages of your development cycle.

A shift-left strategy provides the foundation to build security from the

ground up with necessary automation. It helps you to incorporate
security into every phase of the software pipeline. Security is one of the
key pillars of a well-architected framework, and you should adhere to
the cloud security design principles.

CODE REVIEW
To scale your security and compliance operations, automation is
Peer code reviews are a common practice among development teams.
critical. It would be best to apply security at all layers and automate
You can implement mandatory code reviews to promote secure code
security best practices:
writing by catching common mistakes and vulnerabilities committed
•  Treat your infrastructure as code to source control. When a pull request gets created for a particular
•  Apply security guardrails to your environments functionality, ensure a security focus while reviewing the changes.
Look out for secure practices like sanitizing outputs, proper secret
•  Gain in-depth visibility into your logs and metrics
management, no hardcoding of sensitive data, authentication
•  Establish a scalable incident response system
workflows, session management, logging, and exception handling.
•  Develop the ability to self-heal to a known good state
Most of these steps can be automated by combining SAST (static
AUTOMATED TESTING application security testing) and DAST (dynamic application security
Hardening security requirements during the initial design and testing) tools. SAST analyzes the source code without executing
development phases is essential. It is best to encourage development the application, whereas DAST finds vulnerabilities by analyzing a
teams to keep security in mind while writing unit, integration, and running application. Both of these testing techniques complement
end-to-end tests. As a best practice, do not just focus on happy- each other and help test security vulnerabilities throughout the
path workflows but have effective coverage on negative workflows, software lifecycle.
boundary conditions, and edge cases.
You can use tools to visualize vulnerability data in real time and
Always test the error handling scenarios' authentication workflows and recommend actions to improve the overall security posture in your
maintain extensive coverage for high-risk and frequently used code. organization. While running cloud-native applications, securing both
Since testing is built into the CI/CD process, you cannot release code to the application and infrastructure layer is critical. Traditional security
production without passing tests. tools have limitations in a dynamic cloud environment.

STATIC CODE ANALYSIS As security threats become more sophisticated, the importance of
Static code analysis tools have many security-related rules covering runtime protection and the ability to stop runtime attacks becomes
well-established security standards such as OWASP Top 10 and CWE. of the utmost importance. You can minimize the impact of threats
You can also add custom rules to identify security issues. Security by having runtime security in place — continuous scanning of
injection rules like cross-site scripting, SQL injection, denial of service, environments, having an incident management process, and auditing
and code injection indicate problems at the application level that for security threats in real time.
need to be addressed by developers who follow coding standards.

© DZONE | REFCARD | OCTOBER 2023 4 BROUGHT TO YOU IN PARTNERSHIP WITH

 REFCARD | CLOUD-NATIVE APPLICATION SECURIT Y

CLOUD-NATIVE SECURITY PATTERNS SECRETS MANAGEMENT

AND ANTI-PATTERNS Cloud secrets management refers to tools and methods to securely
The cloud-native architecture enables organizations to build and run manage secrets — passwords, certificates, SSH keys, encryption keys,
scalable applications in a dynamic environment. However, it does and API tokens. You should have a strategy to rotate your passwords
come with several challenges — security, cost, governance, visibility, periodically. Public cloud providers offer managed services to handle
and more. Let us look at some of the best practices every development secrets and their management.
team working in the cloud-native space needs to embrace to secure
PATTERN Policies and procedures for secrets management
their applications. are established, documented, and communicated
across the development teams in your organization.
ZERO-TRUST ARCHITECTURE
ANTI-PATTERN Storing sensitive credentials in code repositories.
Zero trust is a strategic approach to rebuild and modernize security
by enforcing strict access controls to protect data, applications, and
INCIDENT RESPONSE
networks. By inspecting and monitoring network traffic to catch any
Building incident response and triaging strategies are challenging
malicious activity, the zero-trust architecture helps reduce the blast
when you have microservices running in a Kubernetes cluster in a
radius in case of a compromise. In a cloud-native architecture that uses a
cloud-native landscape. When you treat your workloads running in
combination of microservices and containers, service mesh helps reduce
containers as cattle and not pets, performing post-mortem analysis
the surface area of attack and implement the zero-trust security model.
and gathering audit trail events become difficult.
PATTERN Every entity must authenticate itself, and implicit
trust in data and applications is denied even within Containers spin up and down frequently, so responding to security
a network perimeter.
threats in a transient environment requires a different strategy. Incident
ANTI-PATTERNS Workloads are not monitored for misconfigurations response is critical to resolving security issues efficiently and spreading
and vulnerabilities. A least-privilege access
awareness within your organization about operational duties.
strategy between components is not implemented.

PATTERN As you start creating an incident response playbook,

IDENTITY AND ACCESS MANAGEMENT it is crucial to have access to proper observability
IAM is a core component of the security management posture within tools, including logs, metrics, and traces.

an organization that enables the proper entities to access the right ANTI-PATTERN There is no proper audit trail or monitoring to
resources. IAM protects against compromised access, safeguards support troubleshooting activities.

resources within the network, and provides comprehensive security

against phishing and ransomware attacks. DATA PROTECTION
Cloud-native microservices support polyglot persistence; therefore,
PATTERN Following the zero-trust model, each entity is
development teams have flexibility in choosing the appropriate
authenticated and authorized when logging in or
accessing resources. database technology, as seen in Figure 3, for developing their services.

ANTI-PATTERNS Not visualizing IAM as a framework of policies These datastores can store both structured and unstructured data
and processes — like single sign-on, multi-factor
authentication — to help mitigate risk.
to support a variety of functions like search, reporting, time series,
caching, transactional, etc.

PRINCIPLE OF LEAST PRIVILEGE

PATTERN Support critical data management functions like
The least-privilege policy grants permissions to only the resources backup and recovery, archival, data replication,
required to perform the task; no other access gets assigned. Having data encryption at rest, and motion. When it comes
to data auditing, be aware of regulatory compliance
overprivileged users and roles in an organization increases the risk
laws set by the government like HIPAA, GDPR, and
factor. With an increasing number of security breaches caused by FedRAMP to protect consumer rights.
privileged credentials, it is best to always validate policies and adopt
ANTI-PATTERN Excluding data from your automated CI/CD pipeline.
the least-privilege principle by default.

SEE FIGURE 3 ON NEXT PAGE

PATTERN As a security best practice, when you create your IAM
policies, start with a minimum set of permissions
and grant additional permissions as needed.

ANTI-PATTERN Providing broad permissions increases the blast

radius and risk factor.

© DZONE | REFCARD | OCTOBER 2023 5 BROUGHT TO YOU IN PARTNERSHIP WITH

 REFCARD | CLOUD-NATIVE APPLICATION SECURIT Y

Figure 3: Polyglot persistence in cloud-native applications USING INFRASTRUCTURE AS CODE

Cloud-native architectures leverage the principle of immutability to
manage infrastructure resources. If you need to make any configuration
changes, you don’t modify the server; instead, build a new server
with the updated configuration. IaC ensures consistency between
environments and enables better DevOps practices by deploying
infrastructure code in an automated and repeatable manner.

PATTERNS Development and security teams can use IaC

tools like Terraform, Chef, Puppet, and Ansible
to create guardrails, implement policies, patch
vulnerabilities, and fix configuration issues
CONTAINER IMAGE SECURITY seamlessly across environments without worrying
about drifts. With IaC, all your infrastructure
Many organizations are running containerized workloads in production.
changes are peer-reviewed and stored via source
Containers make it easy to package, deploy and run your code, thereby control for increased visibility.
increasing the speed and portability of your application. It is necessary
ANTI-PATTERN Making infrastructure changes manually, which
to secure the container image to secure your environment. creates configuration drifts across environments.

Organizations can leverage open-source tools to detect anomalous

RUNTIME VISIBILITY
behavior of applications running inside containers and send timely
With enterprises growing their workloads rapidly and adapting
alerts. A continuous and automated monitoring strategy is necessary
multi-cluster/multi-cloud environments, it becomes crucial to
to address the increasing security risks associated with container
have a centralized view of your systems. Furthermore, to have a
environments.
sound observability strategy, you need to continuously profile your

As a best practice, ensure that the images don't contain any known applications and collect a considerable volume of data round the clock.

vulnerabilities, do not have passwords and sensitive data included,

PATTERN Provide observability to the teams as a platform
do not contain misconfigurations, and are downloaded from trusted offering — and not something they have to build and
providers. Regularly scanning container registries in your organization maintain for individual services.

is recommended to boost the quality of containerized deployments. ANTI-PATTERN Lack of robust security tooling to make sense of
the high volume of logs, metrics, and trace data
PATTERN Images in popular container registries are not produced by your applications.
guaranteed to be free from vulnerabilities; hence,
you should have a process for vulnerability
scanning of your container images before SHARED RESPONSIBILITY MODEL
deploying them to production. FOR SECURITY
ANTI-PATTERN No automated strategy to periodically scan Security is a shared responsibility between the cloud service provider
container images. and its customers in the public cloud. The shared model helps to reduce
the operational burden on customers, as the cloud provider protects
THREAT MODELING the entire infrastructure containing the service deployments. At the
Developing services in the public cloud can trigger new security threats same time, customers are responsible for securing the application
like malware and ransomware. You can leverage managed services code, data, identity and access, containers, and workloads running in
provided by cloud providers or third-party vendors that use machine the cloud that contain business logic.
learning and artificial intelligence to identify security threats and
Once you have clarity on these shared responsibilities, development
vulnerabilities across your organization.
teams can focus on building business features and not worry about the
PATTERNS Continuously monitor your cloud resources, have day-to-day operational issues in the infrastructure layer.
unified visibility into security incidents, and develop
To summarize, the cloud provider is responsible for the security "of"
a strategy to detect unauthorized activities.
the cloud, whereas the customer is responsible for the security "in"
ANTI-PATTERNS No policies have been created to detect malicious the cloud. Figure 4 illustrates Microsoft's shared responsibility model
activities like suspicious user actions, unsuccessful
in the cloud and the various responsibilities between Microsoft and
login attempts, network anomalies, and unusual
activities that indicate credential compromise. its customers.

SEE FIGURE 4 ON NEXT PAGE

© DZONE | REFCARD | OCTOBER 2023 6 BROUGHT TO YOU IN PARTNERSHIP WITH

 REFCARD | CLOUD-NATIVE APPLICATION SECURIT Y

Figure 4: Microsoft’s shared responsibility model of security frameworks, protecting data at rest and encryption,
reducing sensitive data exposure, implementing secure access
controls, and more.

CONCLUSION
Cloud-native architectures have seen rapid adoption in recent years.
However, there are numerous security challenges due to this complex
and dynamic landscape. Users have faced multiple security risks like
data breaches, data loss, denial of service, insecure APIs, account
hijacking, vulnerabilities, and identity and access management
challenges. Enterprises need to continuously adapt security best
practices to handle these issues, as were outlined in this Refcard.
Image source: "Shared responsibility in the cloud"
These core security concepts cannot be isolated and must be
OWASP FRAMEWORK consistently integrated into the development lifecycle. Enterprises
The OWASP Top 10 is a set of development techniques that helps have been able to find ways to balance security and the speed of
developers improve their web applications' security and enables delivery by embracing automation, continuous delivery, and, most
teams to shift security earlier into the design and coding phases. importantly, building a DevOps culture. It is highly recommended that
It encourages guidelines like integrating security into the CI/CD Refcard readers also study the CNCF Cloud Native Security Whitepaper
pipeline, parameterizing queries, validating all inputs, implementing that focuses on key challenges of cloud-native application security,
error handling, improving logging strategy, leveraging the benefits providing guidance to architects and developers.

Figure 5: OWASP Top 10 web application security risks

Image source: "OWASP Top Ten"

WRITTEN BY SAMIR BEHARA, 3343 Perimeter Hill Dr, Suite 100

Nashville, TN 37211
SENIOR CLOUD INFRASTRUCTURE ARCHITECT, AWS 888.678.0399 | 919.678.0300

Samir builds and architects software solutions At DZone, we foster a collaborative environment that empowers developers and
tech professionals to share knowledge, build skills, and solve problems through
using cutting edge cloud-native technologies.
content, code, and community. We thoughtfully — and with intention — challenge
Samir has worked on large-scale enterprise the status quo and value diverse perspectives so that, as one, we can inspire
applications involving complex business functions, positive change through technology.
web integration, cloud migrations, and data management in various
domains like insurance, manufacturing, and publishing. Samir is a Copyright © 2023 DZone. All rights reserved. No part of this publication may be
frequent speaker at technical conferences and is the Chapter Lead of reproduced, stored in a retrieval system, or transmitted, in any form or by means
the Steel City SQL Server user group. of electronic, mechanical, photocopying, or otherwise, without prior written
permission of the publisher.

© DZONE | REFCARD | OCTOBER 2023 7 BROUGHT TO YOU IN PARTNERSHIP WITH