Cloud Workload Security - Improving Practices for Deployment and Run-Time
May 10, 2022

Yasser Fuentes
Bitdefender

DevOps is considered green when it comes to security practices. Developers are generally focused on the performance and deployment of solutions, rather than their protection. As cloud workload security (CWS) advances from deployment, to mainstream adoption, to run-time optimization, there are certain steps that DevOps teams need to implement to ensure they're properly protecting their projects.

Below, find three critical steps for DevOps teams to improve their CWS protections for application deployment and run-time.

Ensure a proper assessment

The first step to implementing proper security measures to DevOps pipelines is to make sure a proper assessment is performed. It's critical for an organization to understand the risks associated with migration and cloud solution provider infrastructure. This assessment requires DevOps teams to ask multiple questions.

First, what is the shared responsibility of this project?

Consider all parties who will be utilizing this solution and who has a hand in keeping it running once live.

Second, which controls can be used with the current infrastructure, and which ones do you have to implement?

Once a CWS initiative is in active run-time, take note of the security capabilities you are able to immediately implement, and which safeguards are still missing.

Lastly, which security controls are in line with risk management?

Once your initial assessment is complete, make sure that you are allocating adequate security controls to align with risk management initiatives. By performing this assessment, security teams and DevOps developers alike are able to better protect against cyberattacks before and during deployment-especially important in the modern DevOps environment.

Recognize the cybercriminal draw to cloud infrastructure environments

In the current DevOps landscape, there are a number of reasons cybercriminals are shifting attacks to virtualized, and more specifically Linux environments. First, because more than 80 percent of workloads that reside in the cloud/hybrid cloud (both servers and containers) environments run on Linux-based distributions.

Why is this the case?

They're more efficient, easier to manage, they consume less resources, and at their core, they're purpose-built to serve a specific goal. This means that they're more generically built and formulaic, making it easier for cybercriminals to mimic an environment.

Second, Linux-based workloads are the most overlooked across the board in any infrastructure- many believe that because it is open sourced, they're not responsible for securing Linux.

Lastly, most distributions are housed in the open-source realm meaning there's no real commitment to provide security updates and patches, deeming them vulnerable by nature. When deploying a solution on a Linux/open-source environment, DevOps teams should be hyper-aware of the security risks and what this type of environment will mean for security purposes in the long run.

Steps for protecting and deploying container-based applications

With this information in mind, there are key steps for building and deploying more secure virtualized environments. When developing a DevOps initiative, make sure that security is leveraged as part of every stage of the deployment pipeline.

It's important to consider capabilities, such as managed detection and response (MDR) and extended detection and response (XDR), as part of the assessment process during pre-deployment to proactively assess threats, misconfigurations, and vulnerabilities.

Next, when your containers are ready for run-time, make sure you have safeguards for run-time protection. You can build container environments with protections, but without actual run-time protection, those containers remain vulnerable during a successful breach.

Understand that you're responsible for the data that your applications process within the cloud, whether it's owned or not. Once other users adopt your technology, securing the hosted data becomes a shared responsibility.

Each one of these steps will ensure more trustworthy, user-friendly environments.

Conclusion

Remember that security controls by themselves are just a piece of technology. Security controls, in an ideal setting, should be in line with processes and product development. Gearing up for deployment should not mean sacrificing security controls to deploy faster or more efficiently.

Additionally, the DevOps engineers behind these controls must be able to understand the technology, the protocols, and the risks- plus how to effectively take advantage of these technologies to use them to their full potential. By understanding how to protect DevOps initiatives to their fullest, dev teams will ultimately build better, security hardened, container environments.

Yasser Fuentes is Technical Product Manager (Cloud) at Bitdefender
Share this

Industry News

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.

January 25, 2023

Tricentis announced the general availability of Tricentis Test Automation, a cloud-based test automation solution that simplifies test creation, orchestration, and scalable test execution for easier collaboration among QA teams and their business stakeholders and faster, higher-quality, and more durable releases of web-based applications and business processes.

January 24, 2023

Harness announced the acquisition of Propelo.

January 23, 2023

Couchbase announced its Couchbase Capella Database-as-a-Service (DBaaS) offering on Azure.

January 23, 2023

Mendix and Software Improvement Group (SIG) have announced the release of Mendix Quality & Security Management (QSM), a new cybersecurity solution that provides continuous deep-dive insights into security and code quality to immediately address risks and vulnerabilities.

January 23, 2023

Trunk announces the public launch of CI Analytics.

January 23, 2023

Panaya announced a new Partnership Program in response to ongoing growth within its partner network over the past year.

January 23, 2023

Cloudian closed $60 million in new funding, bringing the company’s total funding to $233 million.

January 19, 2023

Progress announced the R1 2023 release of Progress Telerik and Progress Kendo UI.

January 19, 2023

Wallarm announced the early release of the Wallarm API Leak Management solution, an enhanced API security technology designed to help organizations identify and remediate attacks exploiting leaked API keys and secrets, while providing on-going protection against hacks in the event of a leak.

January 19, 2023

ThreatModeler launched Threat Model Marketplace, a cybersecurity asset marketplace offering pre-built, field-tested threat models to be downloaded — free for a limited time — and incorporated into new and ongoing threat modeling initiatives.

January 18, 2023

Software AG has launched new updates to its webMethods platform that will simplify the process by which developers can find, work on and deploy new APIs and integration tools or capabilities.