Cloud native

Be careful with your cloud ☁️

About

Cloud-native security refers to a set of security practices and technologies designed specifically for applications built and deployed in cloud environments. It involves a shift in mindset from traditional security approaches, which often rely on network-based protections, to a more application-focused approach that emphasizes identity and access management, container security and workload security, and continuous monitoring and response.

In a cloud-native security approach, security is built into the application and infrastructure from the ground up, rather than added on as an afterthought. This requires a combination of automated security controls, DevOps processes, and skilled security professionals who can manage the complex and dynamic nature of cloud environments. The goal of cloud native-security is to protect against threats and vulnerabilities that are unique to cloud environments, while also ensuring compliance with regulations and standards. [1]

Best practices

From OWASP Cloud-Native Application Security Top 10 [2] (CNAS, by order), try to avoid:

Resources

Find here a complete list of resources related to cloud security.

Governance

AWS Governance

MultiCloud Governance

Standards

Compliances

Benchmarks

CIS Benchmark

Tools

Infrastructure

aws_pwn: A collection of AWS penetration testing junk
aws_ir: Python installable command line utility for mitigation of instance and key compromises.
aws-firewall-factory: Deploy, update, and stage your WAFs while managing them centrally via FMS.
aws-vault: A vault for securely storing and accessing AWS credentials in development environments.
awspx: A graph-based tool for visualizing effective access and resource relationships within AWS.
azucar: A security auditing tool for Azure environments
checkov: A static code analysis tool for infrastructure-as-code.
cloud-forensics-utils: A python lib for DF & IR on the cloud.
Cloud-Katana: Automate the execution of simulation steps in multi-cloud and hybrid cloud environments.
cloudlist: Listing Assets from multiple Cloud Providers.
Cloud Sniper: A platform designed to manage Cloud Security Operations.
Cloudmapper: Analyze your AWS environments.
Cloudmarker: A cloud monitoring tool and framework.
Cloudsploit: Cloud security configuration checks.
CloudQuery: Open source cloud asset inventory with set of pre-baked SQL policies for security and compliance.
Cloud-custodian: Rules engine for cloud security, cost optimization, and governance.
consoleme: A Central Control Plane for AWS Permissions and Access
cs suite: Tool for auditing the security posture of AWS/GCP/Azure.
Deepfence ThreatMapper: Apache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless.
dftimewolf: A multi-cloud framework for orchestrating forensic collection, processing and data export.
diffy: Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix.
ElectricEye: Continuously monitor AWS services for configurations.
Forseti security: GCP inventory monitoring and policy enforcement tool.
Hammer: A multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources.
kics: Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code.
Matano: Open source serverless security lake platform on AWS that lets you ingest, store, and analyze data into an Apache Iceberg data lake and run realtime Python detections as code.
Metabadger: Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 (IMDSv2).
Open policy agent: Policy-based control tool.
pacbot: Policy as Code Bot.
pacu: The AWS exploitation framework.
Prowler: Command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
ScoutSuite: Multi-cloud security auditing tool.
Security Monkey: Monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
SkyWrapper: Tool helps to discover suspicious creation forms and uses of temporary tokens in AWS.
Smogcloud: Find cloud assets that no one wants exposed.
Steampipe: A Postgres FDW that maps APIs to SQL, plus suites of API plugins and compliance mods for AWS/Azure/GCP and many others.
Terrascan: Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
tfsec: Static analysis powered security scanner for Terraform code.
Zeus: AWS Auditing & Hardening Tool.
AWS Security Benchmark (⚠️): Open source demos, concept and guidance related to the AWS CIS Foundation framework.
AWS Missing Tools by CloudAvail (⚠️): tools for managing AWS resources including EC2, EBS, RDS, IAM, CloudFormation and Route53.

Container

auditkube: Audit for for EKS, AKS and GKE for HIPAA/PCI/SOC2 compliance and cloud security.
Falco: Container runtime security.
mkit: Managed kubernetes inspection tool.
Open policy agent: Policy-based control tool.
Grype: A vulnerability scanner for container images and filesystems.
Kai: KAI (Kubernetes Automated Inventory) can poll Kubernetes Cluster API(s) to tell Anchore which Images are currently in-use.
Syft: CLI tool and library for generating a Software Bill of Materials from container images and filesystems.
Cloudsploit: Cloud Security Posture Management (CSPM).
Kube-Bench: Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
Kube-Hunter: Hunt for security weaknesses in Kubernetes clusters.
Kubectl-who-can: Show who has RBAC permissions to perform actions on different resources in Kubernetes.
Trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more.
Docker - Docker Bench for Security: The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
Elias - Dagda: a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities.
Falco Security - Falco: Cloud Native Runtime Security.
Harbor - Harbor: An open source trusted cloud native registry project that stores, signs, and scans content.
Quay - Clair: Vulnerability Static Analysis for Containers.
Snyk - Snyk: Snyk CLI scans and monitors your projects for security vulnerabilities.
vchinnipilli - Kubestriker: A Blazing fast Security Auditing tool for Kubernetes.

SaaS

aws-allowlister: Automatically compile an AWS Service Control Policy with your preferred compliance frameworks.
binaryalert: Serverless S3 yara scanner.
cloudsplaining: An AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.
Cloud Guardrails: Rapidly cherry-pick cloud security guardrails by generating Terraform files that create Azure Policy Initiatives.
Function Shield: Protection/destection lib of aws lambda and gcp function.
FestIN: S3 bucket finder and content discover.
GCPBucketBrute: A script to enumerate Google Storage buckets.
IAM Zero: Detects identity and access management issues and automatically suggests least-privilege policies.
Lambda Guard: AWS Lambda auditing tool.
Policy Sentry: IAM Least Privilege Policy Generator.
S3 Inspector: Tool to check AWS S3 bucket permissions.
Serverless Goat: A serverless application demonstrating common serverless security flaws.
SkyArk: Tool to helps to discover, assess and secure the most privileged entities in Azure and AWS.
Terraform for Policy Guru (⚠️): Terraform provider for Policy Sentry (IAM least privilege generator and auditor).
Aardvark: Aardvark is a multi-account AWS IAM Access Advisor API.
PolicyUniverse: Parse and Process AWS IAM Policies, Statements, ARNs, and wildcards.
Repokid (⚠️): AWS Least Privilege for Distributed, High-Velocity Deployment.
AWS IAM Generator (⚠️): Generate Multi-Account IAM users/groups/roles/policies from a simple YAML configuration file and Jinja2 templates.
Parliament: AWS IAM linting library.
CloudTracker (⚠️): CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.

Native tools

AWS:
- Artifact: Compliance report selfservice.
- Audit manager: Continuously audit for AWS usage.
- Certificate Manager: Private CA and certificate management service.
- CloudTrail: Record and log API call on AWS.
- Config: Configuration and resources relationship monitoring.
- Elastic Disaster Recovery: Application recovery service.
- Detective: Analyze and visualize security data and help security investigations.
- Firewall Manager: Firewall management service.
- GuardDuty: IDS service
- CloudHSM: HSM service.
- Inspector: Vulnerability discover and assessment service.
- KMS: KMS service
- Macie: Fully managed data security and data privacy service for S3.
- Network Firewall: Network firewall service.
- Secret Manager: Credential management service.
- Security Hub: Integration service for other AWS and third-party security service.
- Shield: DDoS protection service.
- Single Sign-On: Service of centrally manage access AWS or application.
- ThreatMapper: Identify vulnerabilities in running containers, images, hosts and repositories.
- VPC Flowlog: Log of network traffic.
- WAF: Web application firewall service.
Azure:
- Application Gateway: L7 load balancer with optional WAF function.
- DDoS Protection: DDoS protection service.
- Dedicated HSM: HSM service.
- Key Vault: KMS service
- Monitor: API log and monitoring related service.
- Security Center: Integration service for other Azure and third-party security service.
- Sentinel: SIEM service.
GCP:
- Access Transparency: Transparency log and control of GCP.
- Apigee Sense: API security monitoring, detection, mitigation.
- Armor: DDoS protection and WAF service
- Asset Inventory: Asset monitoring service.
- Assured workloads: Secure and compliant workloads.
- Audit Logs: API logs.
- Binanry Authorization: Binary authorization service for containers and serverless.
- Cloud HSM: HSM service.
- Cloud IDS: IDS service.
- Confidential VM: Encrypt data in use with VM.
- Context-aware Access: Enable zero trust access to applications and infrastructure.
- DLP: DLP service:
- EKM: External key management service
- Identity-Aware Proxy: Identity-Aware Proxy for protect the internal service.
- KMS: KMS service
- Policy Intelligence: Detect the policy related risk.
- Security Command Center: Integration service for other GCP security service.
- Security Scanner: Application security scanner for GAE, GCE, GKE.
- Shielded VM: VM with secure boot and vTPM.
- Event Threat Detection: Threat dection service.
- VPC Service Controls: GCP service security perimeter control.