Cloud-native Security Controls

Jan 1, 0001

Definition

Cloud-native security controls are mechanisms specifically designed to protect applications and data in cloud-native environments, such as those using microservices, containers, and Kubernetes. These controls focus on securing the infrastructure, applications, and data by leveraging the cloud provider’s native security features, such as identity and access management, network segmentation, and encryption. They are essential for maintaining the confidentiality, integrity, and availability of resources in dynamic and distributed cloud environments.

Secure Settings Example

# Kubernetes Pod Security Policy Example
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: MustRunAs
    ranges:
      - min: 1
        max: 65535
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'

Insecure Settings Example

# Kubernetes Pod Security Policy Example with Insecure Settings
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: permissive
spec:
  privileged: true
  allowPrivilegeEscalation: true
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
    - '*'