Securing Cloud Containers - Abbas Kudrati

. .

Résumé :

Foreword xxv

Introduction xxvii

Chapter 1 Introduction to Cloud-Based Containers 1

Cloud Caf? Story 1

The Story Continues: The Caf?'s Expansion 2

The Cloud Kitchen Model 3

Making Cloud Kitchen a Success 3

How Containers Changed the Whole Game Plan 3

The New Hub of HiTechville 4

The Evolution of Cloud Infrastructure 4

The Era of Mainframes 4

The Rise of Virtualization 4

The Emergence of Cloud Services 5

The Shift to Containers 5

Introduction to Containers in Cloud Computing 6

The Role of Containers in Modern Cloud Computing 6

Virtual Machines Versus Containers in Cloud Environments 6

Benefits of Using Containers in Cloud 7

Popular Cloud Container Technologies 8

Overview of Cloud-Native Ecosystem for Containers 11

Summary 12

Chapter 2 Cloud-Native Kubernetes: Azure, GCP, and AWS 13

What Is Kubernetes? 15

Managed Kubernetes Services 17

Microsoft Azure Kubernetes Services 17

Google Kubernetes Engine 18

Amazon Elastic Kubernetes Service 19

Azure-, GCP-, and AWS-Managed Kubernetes Service Assessment Criteria 21

Azure, GCP, and AWS Cloud-Native Container Management Services 23

Summary 23

Chapter 3 Understanding the Threats Against Cloud-Based Containerized Environments 25

Initial Stage of Threat Modeling 25

The MITRE ATT&CK Framework 26

Threat Vectors 27

Tactic and Techniques in MITRE ATT&CK 27

Cloud Threat Modeling Using MITRE ATT&CK 31

Cloud Container Threat Modeling 37

Foundations of Cloud Container Threat Modeling 37

Kubernetes Control Plane: Securing the Orchestration Core 37

Worker Nodes: Securing the Execution Environment 38

Cluster Networking: Defending the Communication Fabric 39

Workloads: Hardening Containers and Application Logic 40

IAM: Enforcing Granular Access Across Layers 41

Persistent Storage: Securing Data at Rest 42

CI/CD Pipeline Security: Defending the DevOps Chain 42

Log Monitoring and Visibility: Detecting What Matters 43

Resource Abuse and Resiliency: Planning for the Worst 44

Resource Abuse: Unauthorized Exploitation of Cloud Resources 44

Resiliency and Business Continuity Planning in Kubernetes 46

Compliance and Governance 47

Summary 48

Chapter 4 Secure Cloud Container Platform and Container Runtime 49

Introduction to Cloud-Specific OS and Container Security 49

Cloud-Specific OS: A Shifting Paradigm How OS Should Work 50

Container Security Architecture 51

Host OS Hardening for Container Environments 53

Leverage Container-Optimized OSs 53

Establish and Maintain Secure Configuration Baselines 54

Implement Robust Access Controls and Authentication 55

Apply Timely Security Updates and Patches 55

Implement Host-Based Security Controls 56

Container Runtime Hardening 56

Minimal Container Images 56

Multistage Build 57

Drop Unnecessary Capabilities 57

Implement Seccomp Profiles 58

Resource Controls 59

Use Memory and CPU Limits 60

Process and File Restrictions 60

Logging and Monitoring 61

Regular Security Updates 62

Network Security 62

Implementing Kubernetes Network Policies (netpol) 64

Leveraging Service Mesh for Advanced Secure Communication 64

Leveraging Cloud Network Security Groups 66

Linux Kernel Security Feature for the Container Platform 67

Linux Namespaces, Control Groups, and Capabilities 68

OS-Specific Security Capabilities (SELinux, AppArmor) 69