Cloud Security & DevOps Security
Cloud computing and DevOps practices have transformed how organizations build and deploy applications. This creates a new attack surface spanning infrastructure as code, container images, CI/CD pipelines, and cloud service configurations. Understanding shared responsibility and implementing security throughout the software lifecycle is essential.
Cloud Shared Responsibility Model
The shared responsibility model defines what security tasks are handled by the cloud provider versus the customer. Confusion leads to misconfigurations and breaches.
Infrastructure
Physical security, hypervisor, network controls, managed services.
Configure services securely, patch OS, manage applications.
Virtualization
Host OS, VM isolation, container runtime security.
Guest OS hardening, runtime protections, container security.
Managed Services
Database, storage, serverless function isolation.
Access control, data encryption, input validation.
CIS Benchmarks for Cloud Platforms
Center for Internet Security (CIS) benchmarks provide consensus security guidelines for cloud platforms. Automated tools scan configurations against these benchmarks.
AWS
IAM policies, S3 bucket permissions, security groups, CloudTrail logging.
Prowler, ScoutSuite, Pacu
Azure
Azure AD, NSGs, storage accounts, Key Vault configuration.
Azucar, Stormspotter, ROADtools
GCP
Cloud IAM, VPC firewall rules, storage buckets, audit logs.
GCP Scanner, Forseti, Gopher
Container Security Layers
Container security requires protection at every layer. Each layer has distinct risks and corresponding security controls.
Image
Vulnerable base images, embedded secrets, outdated packages.
Scan images with Trivy/Clair. Use distroless images. Multi-stage builds.
Registry
Unauthenticated pull, unsigned images, no access control.
Private registries. Image signing (cosign). RBAC on registry.
Runtime
Privilege escalation, container escape, resource exhaustion.
Non-root users. Read-only root FS. seccomp/AppArmor profiles.
Orchestration
RBAC misconfiguration, network policies, privileged pods.
RBAC least privilege. Network policies. PodSecurityPolicies/PSA.
DevOps Security Attack Surface
Modern software supply chains are complex. Each component from source to production represents potential attack vectors.
Source Code
Credential leakage, malicious commits, dependency confusion.
Pre-commit hooks, signed commits, SCA scanning, CODEOWNERS.
Build Pipeline
Supply chain compromise, build cache poisoning, env variable exposure.
Isolated runners. Credential scanning. SBOM generation.
Artifact Storage
Tampered releases, vulnerable dependencies, unsigned packages.
Immutable tags. Attestations. Vulnerability gates.
Deployment
Misconfigured IAM, exposed secrets, drift from approved state.
GitOps. Policy as code (OPA). Post-deploy verification.
Key Takeaways
- Shared responsibility means you secure what you configure and deploy.
- Infrastructure as Code should be scanned for misconfigurations before deployment.
- Container images must be scanned for vulnerabilities and signed for integrity.
- CI/CD pipelines are high-value targets—secure with least privilege and scanning.