This document discusses cloud native security and contains the following key points in 3 sentences:
Cloud native security involves securing cloud infrastructure and follows the 4C's of defence-in-depth, complexity, changeability and chaos. A 2020 report found an average of 160 cyber attacks per day in the first half of the year. The document outlines a feedback loop approach to cloud security testing that involves planning, executing, monitoring, analyzing and gaining knowledge from security experiments and observations.
2. Cloud Native Security is about
securing cloud native
infrastructure
The 4C’s of Cloud Native Security
● defence-in-depth
https://kubernetes.io/docs/concepts/security/overview/#the-4c-s-of-cloud-native-security
3. Cloud Native threat Report 2020 - Aqua Security Team
The volume of attacks against honeypots:
~160 attacks per day on average, during the first half of 2020
14. ■ Modes of operation:
□ Low- 30%
□ Medium - 60%
□ High - 90%
■ Attack scenario: chaining of
multiple attack actions
15.
16. PLAN
Apply outcome of analysis to improve
security. Design and plan future
security hypotheses
ANALYZE
Collect and analyze
observations. Vulnerabilities can
be ranked and prioritized
MONITOR
Observe and monitor the execution of
security perturbations. Intervene when
necessary to ensure safety
EXECUTE
Inject security faults based
on crafted hypotheses
KNOWLEDGE
Security insights &
information including
security fault models,
detected vulnerabilities &
analytical outcomes
● adapted from MAPE-K Feedback loop used in autonomous computer systems