Security for Cloud Native Applications : The practical guide for securing modern applications using AWS, Azure, and GCP

✍ Scribed by Estrin, Eyal;

• Publisher: BPB Publications
• Year: 2024
• Tongue: English
• Leaves: 250
• Category: Library

✦ Synopsis

Your practical handbook for securing cloud-native applications KEY FEATURES ● An overview of security in cloud-native applications, such as modern architectures, containers, CI/CD pipeline, and so on. ● Using automation, such as infrastructure as code and policy as code, to achieve security at scale. ● Implementing security, from encryption and secrets management to threat management. DESCRIPTION Security for cloud-native applications is an overview of cloud-native application’s characteristics from a security point of view, filled with best practices for securing services based on AWS, Azure, and GCP infrastructure. This book is a practical guide for securing cloud-native applications throughout their lifecycle. It establishes foundational knowledge of cloud services and cloud-native characteristics. It focuses on securing design approaches like APIs, microservices, and event-driven architectures. Specific technologies like containers, Kubernetes, and serverless functions are covered with security best practices. The book emphasizes integrating security throughout development using CI/CD pipelines and IaC tools. It explores policy as code for enforcing security policies and immutable infrastructure for enhanced security posture. Key management and threat detection strategies are also covered. Finally, the book offers a practical example and resources for further learning. By the end of the book, the reader will be able to design and secure modern applications using the public cloud scale, managed services, automation, and built-in security controls. WHAT YOU WILL LEARN ● How to secure modern design architectures from APIs, event-driven architectures, and microservices. ● How to secure applications using containers and the Kubernetes platform. ● How to secure applications using serverless/function-as-a-service. ● How to implement key and secrets management as part of cloud-native applications. ● How to implement the 12-factor application methodology and immutable infrastructure in cloud-native applications. WHO THIS BOOK IS FOR This book is for security professionals, software development teams, DevOps and cloud architects, and all those who are designing, maintaining, and securing cloud-native applications. TABLE OF CONTENTS 1. Introduction to Cloud Native Applications 2. Securing Modern Design Architectures 3. Containers and Kubernetes for Cloud Native Applications 4. Serverless for Cloud Native Applications 5. Building Secure CI/CD Pipelines 6. The 12-Factor Application Methodology 7. Using Infrastructure as Code 8. Authorization and Policy as Code 9. Implementing Immutable Infrastructure 10. Encryption and Secrets Management 11. Threat Management in Cloud Native Applications 12. Summary and Key Takeaways

✦ Table of Contents

Cover
Title Page
Copyright Page
Dedication Page
About the Author
About the Reviewer
Acknowledgement
Preface
Table of Contents
1. Introduction to Cloud Native Applications
Introduction
Structure
Objectives
Recap of cloud services
Cloud-native services
Cloud-native applications
Conclusion
References
2. Securing Modern Design Architectures
Introduction
Structure
Objectives
Application programmable interfaces
Understanding APIs
Benefits of using APIs
Common use cases for using APIs
Best practices for securing APIs
Transport layer
Authentication and authorization
HTTPS methods
Input validation
API Gateway
Network and application controls
Auditing
Information leakage
Event-driven architectures
Understanding Event-driven architecture
Pub/Sub model
Event streaming model
Benefits of using Event-driven architecture
Common use cases for using Event-driven architecture
External integration
Cross-account/Cross-region data replication
Business workflow
APIs versus Event-driven architecture
Communication method
Data transfer size
Development effort
Resiliency to load and failure
Best practices for securing Event-driven architecture
Network layer
Transport layer
Encryption at rest
Authentication and authorization
Auditing
Microservices architecture
Understanding microservice architecture
Benefits of using microservices architecture
Decoupled architecture
Scalability
Fault isolation and resiliency
Continuous Integration/Continuous Delivery
Language and technology agnostic
Common use cases for using microservices architecture
Modernizing legacy applications
Big data applications
Real-time data processing
Security in Microservices architecture
Conclusion
References
3. Containers and Kubernetes for Cloud Native Applications
Introduction
Structure
Objectives
Containers technology
Understanding Containers
Container components
Benefits of using containers
Excellent use of resources
Reduced overhead
Small footprint
Scalability
Portability
Speed
Developer experience
Best practices for securing containers
Container registry
Least privileged user
Read-only file system
Container image size
Container base image
Container image signing
Handling third-party vulnerabilities
Secrets management
Container host
Network Layer (Docker images)
Container operating systems
Understanding container operating systems
Benefits of container operating system
Small footprint
Improved security
Update mechanism
Immutable file system
Fast boot time
Examples of Container operating systems
AWS Bottlerocket
Google Container-optimized OS
Kubernetes as a Container orchestrator
Understanding Kubernetes
Kubernetes components
Control plane
Serverless control plane
Worker node
Benefits of using Kubernetes
Run anywhere
Automation
Community support
Cloud support
Self-healing capability
Horizontal scaling capability
Portability and vendor lock-in
Cost efficiency
Best practices for securing the Kubernetes platform
Managed Kubernetes
Container OS
Confidential computing
Pod Security
Network layer
Pod to Pod communication
Service mesh
Transport layer
Certificate management
Encryption at Rest
Secrets management
Authentication and authorization
Configuration standard
Security updates
Auditing
Conclusion
References
4. Serverless for Cloud Native Applications
Introduction
Structure
Objectives
Serverless fundamentals
Types of Serverless Services
Compute
Database
Storage
Application integration
Benefits of using Serverless
Time to market
Scalability
High availability
Security
Cost
Introducing Serverless/Function as a Service
Introducing AWS Lambda
Introducing Azure Functions
Introducing Google Cloud Functions
Best practices for securing Serverless/Function as a Service
Securing Containerized Functions
Function isolation
Network layer
Transport layer
Secrets management
Authentication and authorization
Code signing
Vulnerability management
Code repository
Configuration Management
Auditing
Conclusion
References
5. Building Secure CI/CD Pipelines
Introduction
Structure
Objectives
CI/CD pipeline fundamentals
Static Application Security Testing tools
Introducing Static Application Security Testing tools
Embedding SAST as part of the CI/CD pipeline
Examples of open-source SAST tools
Software Composition Analysis tools
Introducing SCA tools
Embedding SCA tools as part of the CI/CD pipeline
Examples of open-source SCA tools
Static code analyzers for Infrastructure as Code
Embedding IaC scanning tools as part of the CI/CD pipeline
Examples of open-source IaC scanning tools
Repositories and artifacts
Using repositories as part of the CI/CD process
Source code and library repositories
AWS CodeCommit
Azure Repos
Google Cloud Source Repositories
Artifact package repositories
AWS CodeArtifact
Azure Artifacts
Google Artifact Registry
Container image repositories
Amazon Elastic Container Registry
Azure Container Registry
Google Artifact Registry
Software supply chain
Definition of software supply chain
Common threats relating to the software supply chain
Introducing Software bill of materials
Amazon Inspector
Azure SBOM Tool
Google Artifact Analysis
Best practices for securing the CI/CD pipeline
Network layer
Transport layer
Authentication and authorization
Design/Plan phase
Code development phase
Build phase
Test phase
Delivery phase
Deployment phase
Operational/Maintenance phase
Auditing
Conclusion
References
6. The 12-Factor Application Methodology
Introduction
Structure
Objectives
The twelve-factor app methodology
Introduction to the 12-Factors application methodology
Codebase
Security best practices
Dependencies
Security best practices
Config
Security best practices
Backing services
Security best practices
Build, release, run
Security best practices
Processes
Security best practices
Port binding
Security best practices
Concurrency
Disposability
Security best practices
Dev/prod parity
Security best practices
Logs
Security best practices
Admin processes
Security best practices
Conclusion
References
7. Using Infrastructure as Code
Introduction
Structure
Objectives
Introduction to Infrastructure as Code
IaC: Declarative versus imperative
Imperative programming
Declarative programming
Benefits of using IaC
AWS CloudFormation
Introduction to AWS CloudFormation templates
Best practices for securing AWS CloudFormation
Identity management
Secrets management
Parameters management
Syntax validation
Policy as code
Network connectivity
Auditing
HashiCorp Terraform
Benefits of using Terraform
Multi-cloud provider support
Community support
State management
Authentication
Authorization
Best practices for securing Terraform
Authentication and authorization
Code repository
State management
Secrets management
Static code analysis
Policy as Code
Auditing
CI/CD pipeline
Configuration management
Using secure Terraform modules
Terraform code samples
Terraform modules on AWS
Terraform modules on Azure
Terraform modules on GCP
Conclusion
References
8. Authorization and Policy as Code
Introduction
Structure
Objectives
Introduction for Policy as Code
Benefits of using Policy as Code
Using AWS Service control policies
Using Azure Policy
Using Google Organization Policy service
Introduction to the HashiCorp Sentinel framework
Using Sentinel to complement Terraform modules
Code samples for Sentinel policies
Introduction to Open Policy Agent
Benefits of using OPA
Authorization process using OPA
Sample “Hello World” policy
Sample code for using OPA to secure Kubernetes
Introduction to Cedar policy language
Authorization process using Cedar
Sample Cedar code
Conclusion
References
9. Implementing Immutable Infrastructure
Introduction
Structure
Objectives
Introduction to immutable infrastructure
Differences between stateful and stateless applications
Introducing Immutable Infrastructure
Benefits of using immutable infrastructure
Building a golden image
Best practices for creating container golden image
Virtual machine image source
Virtual Machine Image update
Virtual Machine Image builder
Container Image source
Container Image Builder
Container registry
Managing persistent data
Managing environment variables
Secrets management
Creating deployment pipeline
Implementing Immutable Infrastructure as part of the CI/CD pipeline
CI/CD pipeline using AWS services
CI/CD pipeline using Azure services
CI/CD pipeline using GCP services
CI/CD pipeline using vendor-agnostic tools
Conclusion
References
10. Encryption and Secrets Management
Introduction
Structure
Objectives
Introducing encryption and key management services
Introducing key management services
Best practices for securing key management services
Introduction to AWS KMS
Best practices for securing AWS KMS
Introduction to Azure Key Vault
Best practices for securing Azure Key Vault
Introduction to Google Cloud KMS
Best practices for securing Google Cloud KMS
Introduction to secrets management in cloud-native applications
Secrets management risks
Best practices for securing secrets management services
Introduction to AWS Secrets Manager
Best practices for securing AWS Secrets Manager
Secrets Management in Azure
Best practices for securing secrets using Azure Key Vault
Introduction to Google Secret Manager
Best practices for securing secrets using Google Secret Manager
Introduction to HashiCorp Vault
Best practices for securing secrets using HashiCorp Vault
Secrets management in Git repositories
Secrets management in the CI/CD pipeline
AWS CodeBuild
Azure DevOps pipelines
Google Cloud Build
Secrets management in Containers
Scanning for secrets inside Container images
Securing access to secrets in Kubernetes
Secrets management in Function-as-a-Service
AWS Lambda
Azure Functions
Google Cloud Functions
Secrets management in Infrastructure-as-Code
Conclusion
References
11. Threat Management in Cloud Native Applications
Introduction
Structure
Objectives
Vulnerability versus threat versus risk
Introducing vulnerability management in Cloud-native applications
Introduction to Amazon Inspector
Amazon Inspector for Containers
Amazon Inspector for Lambda
Best practices for implementing Amazon Inspector
Introduction to Microsoft Defender for Cloud
Microsoft Defender for Containers
Microsoft Defender for Cloud DevOps Security
Best practices for implementing Microsoft Defender for Cloud
Introducing GitHub advanced security for Azure DevOps
Best practices for implementing GitHub Advanced Security for Azure DevOps
Introducing Google vulnerability management services
Best practices for implementing Google vulnerability management services
Implementing threat intelligence at scale
Introduction to Amazon GuardDuty
Best practices for implementing Amazon GuardDuty
Introducing Microsoft Sentinel
Best practices for implementing Microsoft Sentinel
Introducing Google Security Command Center
Best practices for implementing Google Security Command Center
Conclusion
References
12. Summary and Key Takeaways
Introduction
Structure
Objectives
Introducing Pet Store
Key takeaways from the book
Chapter 1, Introduction to Cloud Native Applications: Key takeaways
Chapter 2, Securing Modern Design Architectures: Key takeaways
Chapter 3, Containers and Kubernetes for Cloud Native Applications: Key takeaways
Chapter 4, Serverless for Cloud Native Applications: Key takeaways
Chapter 5, Building Secure CI/CD Pipelines: Key takeaways
Chapter 6, The 12-Factor Application Methodology: Key takeaways
Chapter 7, Using Infrastructure as Code: Key takeaways
Chapter 8, Authorization and Policy as Code: Key takeaways
Chapter 9, Implementing Immutable Infrastructure: Key takeaways
Chapter 10, Encryption and Secrets Management: Key takeaways
Chapter 11, Threat Management in Cloud Native Applications: Key takeaways
Recommendations for the readers of the book
Gain hands-on experience
Share knowledge with your peers
Learn from experts
Index