Cloud-Native Security—What is it and Why it Matters

The term “cloud native” is turning up more and more in vendor promotions and news content, as a growing number of organizations devote more resources to the cloud and make it a bigger part of their overall business strategy.

What does cloud native mean? As with many other technology terms, it means different things to different people. The Cloud Native Computing Foundation (CNCF), an open source software foundation that promotes the adoption of cloud-native computing, says cloud-native technologies empower organizations to build and run scalable applications in modern, dynamic environments such as public, private, and hybrid clouds.

Containers, service meshes, microservices, immutable infrastructure, and declarative application programming interfaces (APIs) exemplify this approach, according to CNCF.

These techniques enable loosely coupled systems that are resilient, manageable, and observable. Combined with robust automation, they allow engineers to make high-impact changes frequently and predictably with minimal toil, the organization says.

For small and mid-sized businesses (SMBs) looking to do more with the cloud, leveraging cloud-native solutions is becoming increasingly important.

What is cloud-native security?

Cloud-native security is a natural follow-on to cloud-native technology in general and is becoming more important given the risks of moving vital data to and from cloud services.

Containers are a good example of a cloud-native technology that can enhance security. They are standalone software packages that bundle all of an application’s code and dependencies to ensure that the application performs reliably regardless of its environment. Containers make it easier for applications to move from one cloud to another.

One example is Linux containers, which provider Red Hat describes as technologies that allow organizations to package and isolate applications with their entire runtime environment—all of the files necessary to run. According to the company, this makes it easy to move the contained application between environments such as development, test, production, etc., while retaining full functionality.

Containers are an important part of cyber security. By building security into the container pipeline and defending the infrastructure, companies can make sure their containers are reliable, scalable, and trusted, Red Hat notes.

The key to enhancing security in the cloud is how these technologies are used, and what the security requirements are for the organization. An organization can run a container workload in a private cloud, public cloud, hybrid cloud, etc. and this then leads to a discussion of security of the cloud v. security in the cloud, or what historically has been referred to as a “shared security model” approach.

What that means is that if you work with a cloud service provider such as Amazon Web Services (AWS) and you host an application, run a container, etc., Amazon is responsible for security of the cloud—meaning the infrastructure, compute resources, and other components. However, the cloud customer is not off the hook with regard to security. It is still responsible for security in the cloud, the applications, containers, etc. Hence the importance of cloud-native security.

Safety as a driver to cloud security

There are benefits to a cloud-native approach, including cloud-native application development. But effective security of the cloud and in the cloud is a must. Ensuring strong security allows organizations to achieve the benefits of the cloud overall.

Some people even talk about cyber security as being a driver to the cloud and an accelerator of business transformation. It’s similar to brakes in a car. Brakes were created to allow a car to go faster, because drivers felt more comfortable going fast when they knew they had a reliable means of slowing down or stopping the vehicle when they needed to.

Cloud security solutions

Bitdefender’s solutions for cloud-native security, and specifically containers, leverage architectural approaches that are a differentiator for its customers. For instance, the company’s Linux agent sits on the Linux kernel, ensuring broad compatibility across Linux distributions and eliminating common delays or the need to sacrifice security when upgrading.

Cloud-native security should continue to be a priority for SMBs and larger organizations as they push further into the cloud. Cloud security concerns remain high as the adoption of public cloud computing continues to surge, according to the 2021 Cloud Security Report from (ISC)2, an international nonprofit membership association focused on inspiring a safe and secure cyber world.

The report, based on a survey of 613 cyber security professionals conducted in May 2021, showed virtually all surveyed professionals (96%) confirm they are at least moderately concerned about public cloud security. A majority of organizations (57%) expect their cloud security budget to increase over the next 12 months. On average, organizations allocate 28% of their security budget to cloud security.

When asked how they would rate their overall security readiness, a majority of the respondents (73%) rate their security readiness average or below average. The continuing shortage of qualified cyber security staff and the lack of security awareness and skills among all employees remains the number one security challenge for organizations, the report said.

Learn more about cloud-native security.

Bitdefender is part of the virtual AWS re:Invent conference. Come visit our 'booth' to learn more.