This document discusses cloud native security and contains the following key points in 3 sentences: Cloud native security involves securing cloud infrastructure and follows the 4C's of defence-in-depth, complexity, changeability and chaos. A 2020 report found an average of 160 cyber attacks per day in the first half of the year. The document outlines a feedback loop approach to cloud security testing that involves planning, executing, monitoring, analyzing and gaining knowledge from security experiments and observations.

1. ChoasCarnival 2021 Kennedy A . Torkura

2. Cloud Native Security is about
securing cloud native
infrastructure
The 4C’s of Cloud Native Security
● defence-in-depth
https://kubernetes.io/docs/concepts/security/overview/#the-4c-s-of-cloud-native-security

3. Cloud Native threat Report 2020 - Aqua Security Team
The volume of attacks against honeypots:
~160 attacks per day on average, during the first half of 2020

4. Complexity is the worst enemy of
security
- Bruce Schneier

5. cloud security incidents
is caused by users
- Gartner
Why?
● Knowledge
● Tooling support

6. ●
●
●

7. ●
●
●

9. ●
●
○
○
○
●
○
○
○
●
○
○
○
●

13. start
create user
Bob
get cloud
buckets
select random
bucket
create
malicious
policy
assign policy
to Bob &
bucket
end
An example of an experiment
hypothesis: cloud buckets are secure

14. ■ Modes of operation:
□ Low- 30%
□ Medium - 60%
□ High - 90%
■ Attack scenario: chaining of
multiple attack actions

16. PLAN
Apply outcome of analysis to improve
security. Design and plan future
security hypotheses
ANALYZE
Collect and analyze
observations. Vulnerabilities can
be ranked and prioritized
MONITOR
Observe and monitor the execution of
security perturbations. Intervene when
necessary to ensure safety
EXECUTE
Inject security faults based
on crafted hypotheses
KNOWLEDGE
Security insights &
information including
security fault models,
detected vulnerabilities &
analytical outcomes
● adapted from MAPE-K Feedback loop used in autonomous computer systems

17. Monitor
Execute Analyze

19. Plan Knowledge-base

20. Security data lake

22. Thank you for
listening !
Kennedy Torkura
@run2obtain