# Security in Cloud-Native Services: A Survey
## 6 Secure Software Development Lifecycle (SDLC)  
Cloud-native services rely on cloud infrastructure to store and process user data, including sensitive information such as personal identification, location, and behavior. This represents a potentially large attack surface for cyber attacks, such as data breaches and malware infections, which could compromise the confidentiality, integrity, and availability of services and user data. To address these security challenges, cloud providers and vendors must collaborate to establish a robust and comprehensive security framework that covers the entire service lifecycle, from design to deployment and maintenance. This framework should consider services' unique security requirements and risks and leverage state-of-the-art security technologies and practices, such as encryption, authentication, access control, and risk management. When speaking about the attack surface, one refers to the collection of all the points where an unauthorized user or an attacker could potentially exploit a vulnerability to gain access to an organization's systems, data, or assets. The attack surface includes all the hardware, software, networks, and interfaces exposed to external or internal threats. The attack surface can be divided into three main categories:  
* **Physical attack surface**[126]: This includes all the physical devices, such as servers, laptops, smartphones, routers, and IoT devices, that an attacker could target to gain unauthorized access. * **Network attack surface**[127]: This includes all the network infrastructure, such as firewalls, routers, switches, and gateways, that an attacker could target to penetrate the organization's network and access its data and systems. * **Software attack surface**[128]: This includes all the software components, such as applications, operating systems, and databases, that an attacker could target to exploit a vulnerability and gain unauthorized access. In this section, we shall concentrate mainly on the Secure Software Development Life Cycle (SDLC). According to [129], data breaches from attackers outside the organization typically amount to about 55% of cases, whereas the remaining 45% are because of misconfiguration or other mistakes. This is a significant statistic and should be considered when aiming to improve the security posture of applications. We must first examine the modern application risk profile to establish a proactive approach. Figure 6 shows a typical cloud-native applications stack. Figure 5: Architecture of the security framework with the enablers and tools, adapted from [19]. Modern cloud-native services leverage technologies such as microservices, containers, and serverless computing. With the increased adoption of cloud-native architecture, the risk profile of the applications stack has also evolved and presents some new and unique security challenges. A cloud-native architecture can be broken down into the following layers:  
* **Application code [130]:** custom code may only make up to 10-20% of the codebase. Any code vulnerabilities must be identified. * **Libraries [36]:** Open source code typically represents up to 80-90% of the code base, whereas open-source software can offer many benefits, such as rapid development and cost-effectiveness, and can also introduce risks. Using open-source code exposes the application to the vulnerabilities that exist in open-source libraries, which attackers can exploit. * **Containers [131]:** Linux packages inherited from public sources. Cloud-native applications rely on many third-party services, which can also introduce security risks. These third-party services may have vulnerabilities or may not have adequate security controls in place. The use of microservices and container technologies in cloud-native applications has increased the complexity of the codebase. This complexity can lead to security gaps, making identifying vulnerabilities and security risks difficult.