Security system for cloud-native environment
According to the composition of the cloud-native environment, the security system for the cloud-native environment can include three levels of security systems, which are container security, orchestration system security, and cloud-native application security. Below, we will explain these three points step by step:
container security
The container environment, or container cloud, is essentially an implementation of cloud computing, which we can call PaaS or CaaS. Container technology is the bottom layer of the cloud-native system, so container security is also the foundation of cloud-native security. In recent years, as container technology has become more and more popular, container security has gradually received widespread attention and attention. From a practical point of view, container escape is easier than virtual machine escape. The security of many container environments is cloud The top priority of native security, container-level security can be divided into the following parts:
- The security of the container environment infrastructure, such as whether the security configuration on the host will affect the containers running on it, whether the security holes and malicious processes on the host will affect the containers, and whether the processes on the containers can take advantage of the security holes on the host wait
- Container image security, including whether there are security vulnerabilities in the software in the image, whether there are security risks in the image construction process, and whether the image is maliciously tampered with during transmission, etc.
- The security of the container at runtime, such as whether there is isolation between the running containers, whether the isolation is sufficient, whether the communication between the container and the container is safe, and whether the malicious program in the container will affect the security of other containers or the host when running , is it safe for the container to use resources, etc.
- The ecological security of the entire container, such as the security of Docker itself, the impact of Service Mesh/Serverless on container security, the management of security keys in containers, and the data privacy protection after containerization, etc.
In addition to physical security, the security of the container cloud environment can be roughly divided into two main aspects: one is the internal security of the container cloud, including host machine security, virtualization security, container network security, management platform security, and data security; Another aspect is the network security between inside and outside the container cloud, which is commonly referred to as north-south network security.
In this way, the security solution for the container cloud can be designed from two aspects. For the north-south network security, the corresponding security detection and protection can be realized through the drainage of security resource pools. This is the most cloud security solution in the industry. way of realization. The security inside the container cloud can be realized through the corresponding container security mechanism. Finally, connect these two parts to the cloud security centralized management system for unified security management and operation
Orchestrating system security
Container technology and orchestration system management system are the two core parts of the cloud-native ecosystem. The container technology is responsible for execution, and the orchestration system is responsible for control and management, which together constitute the cloud-native technology organism. Kubernetes has become the de facto cloud-native orchestration system, so Kubernetes security has become a very important part of orchestration security. As the most popular cloud-native management and orchestration system, Kubernetes has powerful functions, but it also has high program complexity and certain risks, such as the risks of container infrastructure and the existence of Kubernetes component interfaces. Risks, risks in the cluster network, risks in the access control mechanism, vulnerabilities in the software itself, etc.
Cloud Native Application Security
The orchestration system supports many microservice frameworks and cloud-native applications, such as no-service, service grid, etc. These new microservice systems also have various security risks. For example, an attacker obtains the Shell authority of a container running a serverless program by writing a piece of code without a service, and then conducts network penetration into the container. Cloud-native application security includes the following aspects, zero-trust system for cloud-native applications, traditional security mechanisms for cloud-native applications, business security, and API security. Although business security and API security have existed in the Web era, they are New features emerged in the original era