Cloud Native Security

Build Pipeline

Continuous Integration (CI) servers should be isolated and restricted to projects of a similar security classification or sensitivity. Infrastructure builds which require elevated privileges should run on separate, dedicated CI servers. Build policies should be enforced in the CI pipeline and by the orchestrator’s admission controllers.

Image Hardening

Container images are hardened based on industry best practice guidelines. All images are also assessed against the Center for Internet Security (CIS) benchmarks.

Image Scanning

Scanning container images is a critical component of securing container applications throughout the life cycle. It is important to do the scanning in the CI pipeline before deploying the image to production. Incorporating this capability ensures that all the relevant teams have detailed information about all known vulnerabilities and details such as the severity, the CVSS score, and availability of mitigation and fixes.

MATRIXX performs image scanning on a daily basis as part of its vulnerability management program. All discovered issues are analyzed, priority determined and added to the vulnerability register. They are then remediated based on the severity of the issue.

MATRIXX also monitors all images for embedded malware. The monitoring processes include the use of malware signature sets and behavioral detection heuristics based on actual attacks.

Testing

Cloud native applications are subjected to the same suite and standard of quality testing as traditional applications. These include the concepts of clean code, application security scanning and linting through static application security testing (SAST), dependency analysis and scanning, dynamic application security testing (DAST), application instrumentation, and full infrastructure with tests available to developers in local workflows. Automated test results are reported for real-time security assurance to security and compliance teams.

Hardening of infrastructure and workloads is supported by comprehensive test suites, which allows for incremental hardening as the system matures. Tests to verify hardening has occurred are conducted during the build but also executed at deployment to evaluate any changes or regression that may have occurred throughout the life cycle.

Static Analysis and Security Testing

Static analysis cover linting, identifying misconfiguration and vulnerability scanning. The cloud native build pipeline has the same pipeline policy controls as application workloads. Any exposed attack vectors in the configurations are addressed during this process.

Dynamic Analysis

Dynamic analysis of application and infrastructure may include detecting RBAC and other configuration drift. Dynamic analysis is considered to be a part of testing; however, it is performed in a non-production runtime environment.

Security Tests

MATRIXX conducts automated security testing of applications and infrastructure. Test suites are continuously updated to replicate threats in-line with the organizational threat model and can be reused for security regression testing as the system evolves. Automated security testing demonstrates control efficacy on demand by explicitly attempting to carry out threats which improves security and adherence to any embedded compliance requirements in real-time.