Cloud-native security is the integration of security strategies into applications and systems designed to be deployed and to run in cloud environments. It involves a layered approach that considers security at every level of the cloud-native application architecture. The four C’s of cloud-native security are123:
Code: This layer refers to the application code and its dependencies. Security at this layer involves ensuring the code is free of vulnerabilities, using secure coding practices, and implementing encryption, authentication, and authorization mechanisms.
Container: This layer refers to the lightweight, isolated units that encapsulate the application and its dependencies. Security at this layer involves scanning and verifying the container images, enforcing policies and rules for container deployment and runtime, and isolating and protecting the containers from unauthorized access.
Cluster: This layer refers to the group of nodes that host the containers and provide orchestration and management capabilities. Security at this layer involves securing the communication between the nodes and the containers, monitoring and auditing the cluster activity, and applying security patches and updates to the cluster components.
Cloud: This layer refers to the underlying infrastructure and services that support the cloud-native applications. Security at this layer involves configuring and hardening the cloud resources, implementing identity and access management, and complying with the cloud provider’s security standards and best practices.
The correct order of the four C’s from the top (surface) layer to the bottom (base) layer is code, container, cluster, cloud, as each layer depends on the security of the next outermost layer. References: What Is Cloud-Native Security? - Palo Alto Networks, What is Cloud-Native Security? An Introduction | Splunk, The 4C’s of Cloud Native Kubernetes security - Medium
