The cloud native technology ecosystem is a developer’s paradise.

There’s endless scope for experimentation and innovation, infinite possibilities for management and scaling, and a real potential to revolutionize expectations of modern applications. Perhaps best of all, every aspect is dynamic—new technologies lead to new capabilities that offer benefits while cutting costs.

And yet. . .and yet. . .the nagging fear of less-than-desirable security always gets in the way of a truly positive experience. The extensive damage—30 billion-plus records exposed from 200 breaches in just the past two years—is plain to see.

But with all the operational advances, current security practices are becoming obsolete. Development velocity far outpaces security velocity: While developers programmatically define cloud native infrastructure—which is clearly a good thing—security teams are manually mitigating risks in runtime. They lack meaningful context about application architecture to be able to automate issue resolution. In the broader sense, even when cloud infrastructure misconfigurations are detected, many aren’t addressed. Accurics research finds that perhaps only 4% of security issues reported in production are resolved.

With this backdrop, the constant breaches are actually not a surprise. But it doesn’t have to be this way.

The shift to Infrastructure as Code (IaC) has created an opportunity for security to be embedded earlier into the development lifecycle. And as developers embrace IaC, they also inherit responsibility for securing infrastructure. Developing policy guardrails to spot issues is a start, but without significant context it’s hard to separate true risks from trivial errors inside complex architectures. Further, lacking automated remedies only adds to the ‘noise’—and the alert fatigue is already high.

Compounding the issue is the fact that operations teams make changes to cloud infrastructure in runtime. Research from Accurics shows that 90% of organizations allow this practice and despite best efforts, the secure posture established through IaC during development will ultimately drift.

To make a real difference, we need a fundamentally different approach that integrates security into development workflows. Programmatic risk detection must be paired with programmatic risk resolution, a process to self-heal cloud native infrastructure throughout the development lifecycle. Working in an IaC environment that’s always being enhanced (and challenged) with new technologies means there will always be risk, but it’s important to programmatically detect and resolve these before infrastructure is provisioned. The secure posture can only be maintained in runtime by programmatically mitigating risks through IaC.

So what key capabilities are needed to enable this new approach to securing cloud infrastructure?

Let’s consider a new set of pillars to define the requirements:

● Policy as Code: Set rules and enforce them—while developers provision and manage cloud native infrastructure, it’s vital to ensure that security best practices and compliance requirements are observed without slowing down development. It’s equally important to enforce the same rules after the cloud infrastructure has been provisioned to maintain the secure posture.
● Security as Code: While new cloud native technologies such as serverless, containers, and service mesh deliver significant benefits, they add to the complexity in the infrastructure stack, and that makes it harder to identify risks. What’s needed is a way to model threats and prioritize the highest severity risks for resolution. This enables a truly comprehensive security strategy.
● Drift as Code: Start by detecting and mitigating all risks within IaC to establish a secure baseline, and ensure that any deviation from it in runtime is identified, analyzed and remediated.
● Remediation as Code: Let’s acknowledge alert fatigue, because it’s a natural human response to the constant barrage of warnings, many of which are likely non-exploitable issues. And the automatic detection of policy violations and threats across constantly changing cloud native infrastructure adds to this. Self-healing is critical: When a policy violation occurs or a breach path is identified, the necessary code should be automatically generated to resolve the problem. Remediation workflows must be integrated into development pipelines to ensure that security doesn’t hinder development.

Cloud native is the promised land for developers – a world where they can constantly create applications without boundaries. Any change in direction or priority from this basic mindset undermines the fundamental promise of this exciting discipline.

However. . .innovation without accompanying security poses significant risk. For cloud native infrastructure to deliver matchless benefits, particularly with the constant addition of new technologies, organizations must have the ability to programmatically detect and resolve risks. This will ultimately allow infrastructure to self-heal, enabling developers to build cyber resilient infrastructure. The process must be programmatic and across the full development lifecycle. That’s the only way to ensure that innovation actually does deliver the goods.

To learn more about containerized infrastructure and cloud native technologies, consider joining us at KubeCon + CloudNativeCon NA Virtual, November 17-20.