Cloud Workload Security - Improving Practices for Deployment and Run-Time
May 10, 2022

Yasser Fuentes
Bitdefender

DevOps is considered green when it comes to security practices. Developers are generally focused on the performance and deployment of solutions, rather than their protection. As cloud workload security (CWS) advances from deployment, to mainstream adoption, to run-time optimization, there are certain steps that DevOps teams need to implement to ensure they're properly protecting their projects.

Below, find three critical steps for DevOps teams to improve their CWS protections for application deployment and run-time.

Ensure a proper assessment

The first step to implementing proper security measures to DevOps pipelines is to make sure a proper assessment is performed. It's critical for an organization to understand the risks associated with migration and cloud solution provider infrastructure. This assessment requires DevOps teams to ask multiple questions.

First, what is the shared responsibility of this project?

Consider all parties who will be utilizing this solution and who has a hand in keeping it running once live.

Second, which controls can be used with the current infrastructure, and which ones do you have to implement?

Once a CWS initiative is in active run-time, take note of the security capabilities you are able to immediately implement, and which safeguards are still missing.

Lastly, which security controls are in line with risk management?

Once your initial assessment is complete, make sure that you are allocating adequate security controls to align with risk management initiatives. By performing this assessment, security teams and DevOps developers alike are able to better protect against cyberattacks before and during deployment-especially important in the modern DevOps environment.

Recognize the cybercriminal draw to cloud infrastructure environments

In the current DevOps landscape, there are a number of reasons cybercriminals are shifting attacks to virtualized, and more specifically Linux environments. First, because more than 80 percent of workloads that reside in the cloud/hybrid cloud (both servers and containers) environments run on Linux-based distributions.

Why is this the case?

They're more efficient, easier to manage, they consume less resources, and at their core, they're purpose-built to serve a specific goal. This means that they're more generically built and formulaic, making it easier for cybercriminals to mimic an environment.

Second, Linux-based workloads are the most overlooked across the board in any infrastructure- many believe that because it is open sourced, they're not responsible for securing Linux.

Lastly, most distributions are housed in the open-source realm meaning there's no real commitment to provide security updates and patches, deeming them vulnerable by nature. When deploying a solution on a Linux/open-source environment, DevOps teams should be hyper-aware of the security risks and what this type of environment will mean for security purposes in the long run.

Steps for protecting and deploying container-based applications

With this information in mind, there are key steps for building and deploying more secure virtualized environments. When developing a DevOps initiative, make sure that security is leveraged as part of every stage of the deployment pipeline.

It's important to consider capabilities, such as managed detection and response (MDR) and extended detection and response (XDR), as part of the assessment process during pre-deployment to proactively assess threats, misconfigurations, and vulnerabilities.

Next, when your containers are ready for run-time, make sure you have safeguards for run-time protection. You can build container environments with protections, but without actual run-time protection, those containers remain vulnerable during a successful breach.

Understand that you're responsible for the data that your applications process within the cloud, whether it's owned or not. Once other users adopt your technology, securing the hosted data becomes a shared responsibility.

Each one of these steps will ensure more trustworthy, user-friendly environments.

Conclusion

Remember that security controls by themselves are just a piece of technology. Security controls, in an ideal setting, should be in line with processes and product development. Gearing up for deployment should not mean sacrificing security controls to deploy faster or more efficiently.

Additionally, the DevOps engineers behind these controls must be able to understand the technology, the protocols, and the risks- plus how to effectively take advantage of these technologies to use them to their full potential. By understanding how to protect DevOps initiatives to their fullest, dev teams will ultimately build better, security hardened, container environments.

Yasser Fuentes is Technical Product Manager (Cloud) at Bitdefender
Share this

Industry News

January 16, 2025

Mendix, a Siemens business, announced the general availability of Mendix 10.18.

January 16, 2025

Red Hat announced the general availability of Red Hat OpenShift Virtualization Engine, a new edition of Red Hat OpenShift that provides a dedicated way for organizations to access the proven virtualization functionality already available within Red Hat OpenShift.

January 16, 2025

Contrast Security announced the release of Application Vulnerability Monitoring (AVM), a new capability of Application Detection and Response (ADR).

January 15, 2025

Red Hat announced the general availability of Red Hat Connectivity Link, a hybrid multicloud application connectivity solution that provides a modern approach to connecting disparate applications and infrastructure.

January 15, 2025

Appfire announced 7pace Timetracker for Jira is live in the Atlassian Marketplace.

January 14, 2025

SmartBear announced the availability of SmartBear API Hub featuring HaloAI, an advanced AI-driven capability being introduced across SmartBear's product portfolio, and SmartBear Insight Hub.

January 14, 2025

Azul announced that the integrated risk management practices for its OpenJDK solutions fully support the stability, resilience and integrity requirements in meeting the European Union’s Digital Operational Resilience Act (DORA) provisions.

January 14, 2025

OpsVerse announced a significantly enhanced DevOps copilot, Aiden 2.0.

January 13, 2025

Progress received multiple awards from prestigious organizations for its inclusive workplace, culture and focus on corporate social responsibility (CSR).

January 13, 2025

Red Hat has completed its acquisition of Neural Magic, a provider of software and algorithms that accelerate generative AI (gen AI) inference workloads.

January 13, 2025

Code Intelligence announced the launch of Spark, an AI test agent that autonomously identifies bugs in unknown code without human interaction.

January 09, 2025

Checkmarx announced a new generation in software supply chain security with its Secrets Detection and Repository Health solutions to minimize application risk.

January 08, 2025

SmartBear has appointed Dan Faulkner, the company’s Chief Product Officer, as Chief Executive Officer.

January 07, 2025

Horizon3.ai announced the release of NodeZero™ Kubernetes Pentesting, a new capability available to all NodeZero users.

January 06, 2025

GitHub announced GitHub Copilot Free.