# Security in Cloud-Native Services: A Survey
## 6 Secure Software Development Lifecycle (SDLC)
### Shift Left and Static Testing Techniques for Enhancing Security
Falco, a cloud-native threat detection engine, relies on monitoring Linux system calls in containers to flag unexpected behaviors (e.g., privilege escalation events, suspicious reads/writes to known directories). To accomplish that, Falco uses a set of predefined rules. Similarly, Curiefense is a cloud-native tool capable of monitoring HTTP API requests and detecting suspicious behaviors on HTTP traffic between containers. Despite all the benefits of such tools, most existing tools mainly rely on using hard-coded rules, which might limit them to only known vulnerabilities. Cloud-native security can be split into four key levels, the so-called \"4C's\": the security of cloud, clusters, containers, and code. Cloud security [148] concerns the security of the underlying cloud environment. It is essential to ensure the principle of least privilege to control, amongst others, the (network) access to the environment APIs, cloud provider APIs, and nodes. The authors of [149] include the protection of the components of the cluster (the applications). Their access should include authentication and admission control mechanisms. For instance, network and pod policies are used as an admission control method for controlling the allowed traffic and pod operations. Container security [150] refers to implementing the best security practices to ensure containers are free from vulnerabilities. This might include the search for vulnerabilities, image signing to enforce the usage of trustable images, and avoiding (detecting) running containers as privileged users. Code security [151] encompasses methods to verify third-party libraries that may be used, all the code and dynamic testing, the limitation of allowed ports, and the usage of TLS or mTLS in all network communications. The Center for Internet Security (CIS) Kubernetes Benchmarks [[https://www.cisecurity.org/benchmark/kubernetes](https://www.cisecurity.org/benchmark/kubernetes)]([https://www.cisecurity.org/benchmark/kubernetes](https://www.cisecurity.org/benchmark/kubernetes)) (accessed on 15 August 2023) provides guidelines for cybersecurity best practice recommendationsfor configuring Kubernetes. The main goal is to provide a set of recommendations for Kubernetes to improve security against threats. Moreover, in accordance with the zero-trust model that was explored earlier, each component should only be given the least amount of privileges it needs. For instance, this might help to contain a lateral movement in the case of a compromised element. Nevertheless, this is a significant challenge in cloud-native environments when considering all heterogeneous assets used to support cloud-native applications (e.g., enforcing a common security strategy from the infrastructure and orchestration layers up to the various containers constituting the application). In the same way, encryption-based techniques for protecting data access are both a sensible choice and a mandatory requirement in several scenarios. For instance, the network communications between containers should be encrypted. This can be natively supported in the application logic or realized, as stated before, with the concept of service meshes. Istio is a cloud-native service mesh implementation that aims to support the orchestration of microservices which, together with Envoy proxies, allows the implementation of various traffic management techniques, including the dynamic enforcing of mutual TLS between service communications. Tools such as Kube-bench [152] and InSpec [[https://www.chef.io/products/chef-inspec](https://www.chef.io/products/chef-inspec)]([https://www.chef.io/products/chef-inspec](https://www.chef.io/products/chef-inspec)) (accessed on 15 August 2023) can be used to perform such security assessments [153]. Kube-bench allows automating the implementation of CIS Benchmarks, offering recommendation actions for detected issues. Similarly, InSpec allows the automation of infrastructure testing, auditing of applications, and policy conformance.