Cloud Workload Security - Improving Practices for Deployment and Run-Time
May 10, 2022

Yasser Fuentes

DevOps is considered green when it comes to security practices. Developers are generally focused on the performance and deployment of solutions, rather than their protection. As cloud workload security (CWS) advances from deployment, to mainstream adoption, to run-time optimization, there are certain steps that DevOps teams need to implement to ensure they're properly protecting their projects.

Below, find three critical steps for DevOps teams to improve their CWS protections for application deployment and run-time.

Ensure a proper assessment

The first step to implementing proper security measures to DevOps pipelines is to make sure a proper assessment is performed. It's critical for an organization to understand the risks associated with migration and cloud solution provider infrastructure. This assessment requires DevOps teams to ask multiple questions.

First, what is the shared responsibility of this project?

Consider all parties who will be utilizing this solution and who has a hand in keeping it running once live.

Second, which controls can be used with the current infrastructure, and which ones do you have to implement?

Once a CWS initiative is in active run-time, take note of the security capabilities you are able to immediately implement, and which safeguards are still missing.

Lastly, which security controls are in line with risk management?

Once your initial assessment is complete, make sure that you are allocating adequate security controls to align with risk management initiatives. By performing this assessment, security teams and DevOps developers alike are able to better protect against cyberattacks before and during deployment-especially important in the modern DevOps environment.

Recognize the cybercriminal draw to cloud infrastructure environments

In the current DevOps landscape, there are a number of reasons cybercriminals are shifting attacks to virtualized, and more specifically Linux environments. First, because more than 80 percent of workloads that reside in the cloud/hybrid cloud (both servers and containers) environments run on Linux-based distributions.

Why is this the case?

They're more efficient, easier to manage, they consume less resources, and at their core, they're purpose-built to serve a specific goal. This means that they're more generically built and formulaic, making it easier for cybercriminals to mimic an environment.

Second, Linux-based workloads are the most overlooked across the board in any infrastructure- many believe that because it is open sourced, they're not responsible for securing Linux.

Lastly, most distributions are housed in the open-source realm meaning there's no real commitment to provide security updates and patches, deeming them vulnerable by nature. When deploying a solution on a Linux/open-source environment, DevOps teams should be hyper-aware of the security risks and what this type of environment will mean for security purposes in the long run.

Steps for protecting and deploying container-based applications

With this information in mind, there are key steps for building and deploying more secure virtualized environments. When developing a DevOps initiative, make sure that security is leveraged as part of every stage of the deployment pipeline.

It's important to consider capabilities, such as managed detection and response (MDR) and extended detection and response (XDR), as part of the assessment process during pre-deployment to proactively assess threats, misconfigurations, and vulnerabilities.

Next, when your containers are ready for run-time, make sure you have safeguards for run-time protection. You can build container environments with protections, but without actual run-time protection, those containers remain vulnerable during a successful breach.

Understand that you're responsible for the data that your applications process within the cloud, whether it's owned or not. Once other users adopt your technology, securing the hosted data becomes a shared responsibility.

Each one of these steps will ensure more trustworthy, user-friendly environments.


Remember that security controls by themselves are just a piece of technology. Security controls, in an ideal setting, should be in line with processes and product development. Gearing up for deployment should not mean sacrificing security controls to deploy faster or more efficiently.

Additionally, the DevOps engineers behind these controls must be able to understand the technology, the protocols, and the risks- plus how to effectively take advantage of these technologies to use them to their full potential. By understanding how to protect DevOps initiatives to their fullest, dev teams will ultimately build better, security hardened, container environments.

Yasser Fuentes is Technical Product Manager (Cloud) at Bitdefender
Share this

Industry News

June 01, 2023

Couchbase announced a broad range of enhancements to its Database-as-a-Service Couchbase Capella™.

June 01, 2023

Remote.It release of Docker Network Jumpbox to enable zero trust container access for Remote.It users.

June 01, 2023

Platformatic launched a suite of new enterprise-grade products that can be self-hosted on-prem, in a private cloud, or on Platformatic’s managed cloud service:

May 31, 2023

Parasoft announced the release of C/C++test 2023.1 with complete support of MISRA C 2023 and MISRA C 2012 with Amendment 4.

May 31, 2023

Rezilion announced the release of its new Smart Fix feature in the Rezilion platform, which offers critical guidance so users can understand the most strategic, not just the most recent, upgrade to fix vulnerable components.

May 31, 2023

Zesty has partnered with skyPurple Cloud, the public cloud operations specialists for enterprises.

With Zesty, skyPurple Cloud's customers have already reduced their average monthly EC2 Linux On-Demand costs by 44% on AWS.

May 30, 2023

Red Hat announced Red Hat Trusted Software Supply Chain, a solution that enhances resilience to software supply chain vulnerabilities.

May 30, 2023

Mirantis announced Lens Control Center, to enable large businesses to centrally manage Lens Pro deployments by standardizing configurations, consolidating billing, and enabling control over outbound network connections for greater security.

May 25, 2023

Red Hat announced new capabilities for Red Hat OpenShift AI.

May 25, 2023

Pipedrive announced the launch of Developer Hub, a centralized online app development platform for technology partners and developers.

May 25, 2023

Delinea announced the latest version of Cloud Suite, part of its Server PAM solution, which provides privileged access to and authorization for servers.

May 24, 2023

Red Hat announced Red Hat Service Interconnect, simplifying application connectivity and security across platforms, clusters and clouds.

May 24, 2023

Teleport announced Teleport 13, the latest version of its Teleport Access Platform to enhance security and reduce operational overhead for DevOps teams responsible for securing cloud infrastructure.

May 24, 2023

Kasten by Veeam announced the release of its new Kasten K10 V6.0 Kubernetes data protection platform.

May 23, 2023

Red Hat announced Red Hat Developer Hub, an enterprise-grade, unified and open portal designed to streamline the development process through a supported and opinionated framework.