- Cloud Security Newsletter
- Posts
- Confidential Computing and Container Security
Confidential Computing and Container Security
Learn about balancing Confidentiality using Cloud Native services from NVIDIA, Intel & Goldman Sachs
Shilpi Bhattacharjee
August 03, 2024
Hello from the Cloud-verse!
This week’s Cloud Security Newsletter Topic is Confidential Computing and Container Security! (continue reading)
Incase, this is your 1st Cloud Security Newsletter!
Welcome, we are a Weekly newsletter from the team behind Cloud Security Podcast & AI CyberSecurity Podcast deep diving into top of mind topics in emerging technology to make sure collectively we feel confident securing things in this every changing world of Cloud, AI and whatever comes next.
Who else is here reading with you?
Ashish & Shilpi, from the weekly show Cloud Security Podcast, friends and colleagues from companies like Netflix, JP Morgan, Linkedin, Reddit, Github, Gitlab, CapitalOne, Robinhood, HSBC, British Airways, Airbnb & more who subscribe to this newsletter. If you are reading this - thank you for supporting us.
This image was created using DALL-E
Cloud Security Topic of the Week
Confidential Computing and Container Security
NVIDIA, Intel, Goldman Sachs & more in the regulated industry are adopting Confidential Computing in Cloud native environments these days. We are spilling the beans on Confidential Computing, Container Security and how it all fits into cloud-native architectures in this issue of Cloud Security Newsletter, with insights from our latest episode with Zvonko Kaiser from NVIDIA, with complementary perspectives from Steve Orrin of Intel and Karthik Ramamurthy of Goldman Sachs.
"With virtual machines, you have full control on all the seven layers in your operating system. [...] Those days are gone. That’s why like we focus more on shift left, specifically for cloud native workloads."
Definitions:
Containers: Lightweight, portable units for hosting & running packaged application code and related dependencies for consistent deployment across all application environments.
Cloud Native: An approach to building and running applications that fully take advantage of the native services provided by the cloud computing model.
Confidential Computing: Technology that encrypts “data in use”, protecting it even from the underlying infrastructure.
Attestation: The process of cryptographically verifying the integrity and authenticity of software and hardware components.
Runtime Security: Protecting containers during their execution, monitoring for and responding to threats in real-time.
Container Breakout: A security breach where an attacker escapes the isolation of a container to access the host system or other containers.
"Confidential computing, confidential containers is something that you probably will start hearing more often now that CNCF, NVIDIA, and a lot of other people have started talking about it as well."
Key Insights
Containers have become the foundation for modern application architectures (including AI enabled applications), enabling packaged deployments with vertical and horizontal scaling for micro service applications.
The shift to containers demands new security approaches compared to traditional VM-based systems.
Confidential computing adds an extra layer of security for sensitive workloads in shared cloud environments which is essential requirement for regulated and public sector companies.
Major cloud providers now offer native confidential computing options for containers in their platform.
Security Best Practices and Actionable Steps
Assess your current application architecture and identify potential areas for containerization.
Evaluate your organization's need for confidential computing based on data sensitivity and regulatory requirements.
Explore confidential computing offerings from your cloud provider for container workloads.
Start small with a pilot project to gain hands-on experience with container security.
Use an Industry framework as base framework to identify gaps in your current container security strategy like the NIST Cybersecurity Framework
Develop Security Policy (Baseline) a set of baseline security policies for your container environments and codify them + incident response plans specifically for container-based environments.
Implement attestation mechanisms to verify the integrity of your container environment.
Develop a maturity model for your organization's container security based on the framework.
Integrate security scanning and policy checks into your CI/CD pipeline for containers.
Implement tools like OPA (Open Policy Agent) or Gatekeeper for policy enforcement in Kubernetes + runtime security tools that can monitor container behavior and detect anomalies.
Educate your team on cloud-native principles and container security basics.
Regularly conduct penetration testing and security assessments of your container infrastructure.
"People are used to run random bash scripts or models from the internet, right? You shouldn't do that, right? You should check what you're running and confidential compute will not save your confidential data from running a random script from the Internet."
This week’s Cloud Security Quiz - All the Best!
What is Confidential Computing? |
The correct answer was “From the beginning“.
🤖 Are you interested in AI Cybersecurity?
Then you should definitely checkout our sister podcast AI Cybersecurity Podcast that is hosted by Ashish Rajan and Caleb Sima.
👩🏽💻Cloud Security Training from Practitioners!
Want to learn more about Cloud Security or know someone who wants to, we got you !
If you have been following our journey for a while, you would know that one of the big reasons we started Cloud Security Podcast was to make cloud security knowledge accessible for anyone wanting to learn it.
Have you joined our FREE Monthly Cloud Security Bootcamp yet. There are paid online and corporate trainings available for those looking to hit their Cloud Security goals this year!
We would love to hear from you📢 for a feature or topic request or if you would like to sponsor an edition of Cloud Security Newsletter.
Thank you for continuing to subscribe and Welcome to the new members in tis newsletter community💙
Hope you are enjoying this new look Cloud Security Newsletter, there’s plenty more to come.
Peace!
Was this forwarded to you? You can Sign up here, if this was helpful for you.
Want to sponsor the next newsletter edition! Lets make it happen