Cloud Native Security
Home > Computing and Information Technology > Computer networking and communications > Network security > Cloud Native Security
Cloud Native Security

Cloud Native Security


     0     
5
4
3
2
1



Available


X
About the Book

Explore the latest and most comprehensive guide to securing your Cloud Native technology stack Cloud Native Security delivers a detailed study into minimizing the attack surfaces found on today's Cloud Native infrastructure. Throughout the work hands-on examples walk through mitigating threats and the areas of concern that need to be addressed. The book contains the information that professionals need in order to build a diverse mix of the niche knowledge required to harden Cloud Native estates. The book begins with more accessible content about understanding Linux containers and container runtime protection before moving on to more advanced subject matter like advanced attacks on Kubernetes. You'll also learn about: Installing and configuring multiple types of DevSecOps tooling in CI/CD pipelines Building a forensic logging system that can provide exceptional levels of detail, suited to busy containerized estates Securing the most popular container orchestrator, Kubernetes Hardening cloud platforms and automating security enforcement in the cloud using sophisticated policies Perfect for DevOps engineers, platform engineers, security professionals and students, Cloud Native Security will earn a place in the libraries of all professionals who wish to improve their understanding of modern security challenges.

Table of Contents:
Introduction xix Part I Container and Orchestrator Security 1 Chapter 1 What is a Container? 3 Common Misconceptions 4 Container Components 6 Kernel Capabilities 7 Other Containers 13 Summary 14 Chapter 2 Rootless Runtimes 17 Docker Rootless Mode 18 Installing Rootless Mode 20 Running Rootless Podman 25 Setting Up Podman 26 Summary 31 Chapter 3 Container Runtime Protection 33 Running Falco 34 Configuring Rules 38 Changing Rules 39 Macros 41 Lists 41 Getting Your Priorities Right 41 Tagging Rulesets 42 Outputting Alerts 42 Summary 43 Chapter 4 Forensic Logging 45 Things to Consider 46 Salient Files 47 Breaking the Rules 49 Key Commands 52 The Rules 52 Parsing Rules 54 Monitoring 58 Ordering and Performance 62 Summary 63 Chapter 5 Kubernetes Vulnerabilities 65 Mini Kubernetes 66 Options for Using kube-hunter 68 Deployment Methods 68 Scanning Approaches 69 Hunting Modes 69 Container Deployment 70 Inside Cluster Tests 71 Minikube vs. kube-hunter 74 Getting a List of Tests 76 Summary 77 Chapter 6 Container Image CVEs 79 Understanding CVEs 80 Trivy 82 Getting Started 83 Exploring Anchore 88 Clair 96 Secure Registries 97 Summary 101 Part II DevSecOps Tooling 103 Chapter 7 Baseline Scanning (or, Zap Your Apps) 105 Where to Find ZAP 106 Baseline Scanning 107 Scanning Nmap’s Host 113 Adding Regular Expressions 114 Summary 116 Chapter 8 Codifying Security 117 Security Tooling 117 Installation 118 Simple Tests 122 Example Attack Files 124 Summary 127 Chapter 9 Kubernetes Compliance 129 Mini Kubernetes 130 Using kube-bench 133 Troubleshooting 138 Automation 139 Summary 140 Chapter 10 Securing Your Git Repositories 141 Things to Consider 142 Installing and Running Gitleaks 144 Installing and Running GitRob 149 Summary 151 Chapter 11 Automated Host Security 153 Machine Images 155 Idempotency 156 Secure Shell Example 158 Kernel Changes 162 Summary 163 Chapter 12 Server Scanning With Nikto 165 Things to Consider 165 Installation 166 Scanning a Second Host 170 Running Options 171 Command-Line Options 172 Evasion Techniques 172 The Main Nikto Configuration File 175 Summary 176 Part III Cloud Security 177 Chapter 13 Monitoring Cloud Operations 179 Host Dashboarding with NetData 180 Installing Netdata 180 Host Installation 180 Container Installation 183 Collectors 186 Uninstalling Host Packages 186 Cloud Platform Interrogation with Komiser 186 Installation Options 190 Summary 191 Chapter 14 Cloud Guardianship 193 Installing Cloud Custodian 193 Wrapper Installation 194 Python Installation 195 EC2 Interaction 196 More Complex Policies 201 IAM Policies 202 S3 Data at Rest 202 Generating Alerts 203 Summary 205 Chapter 15 Cloud Auditing 207 Runtime, Host, and Cloud Testing with Lunar 207 Installing to a Bash Default Shell 209 Execution 209 Cloud Auditing Against Benchmarks 213 AWS Auditing with Cloud Reports 215 Generating Reports 217 EC2 Auditing 219 CIS Benchmarks and AWS Auditing with Prowler 220 Summary 223 Chapter 16 AWS Cloud Storage 225 Buckets 226 Native Security Settings 229 Automated S3 Attacks 231 Storage Hunting 234 Summary 236 Part IV Advanced Kubernetes and Runtime Security 239 Chapter 17 Kubernetes External Attacks 241 The Kubernetes Network Footprint 242 Attacking the API Server 243 API Server Information Discovery 243 Avoiding API Server Information Disclosure 244 Exploiting Misconfigured API Servers 245 Preventing Unauthenticated Access to the API Server 246 Attacking etcd 246 etcd Information Discovery 246 Exploiting Misconfigured etcd Servers 246 Preventing Unauthorized etcd Access 247 Attacking the Kubelet 248 Kubelet Information Discovery 248 Exploiting Misconfigured Kubelets 249 Preventing Unauthenticated Kubelet Access 250 Summary 250 Chapter 18 Kubernetes Authorization with RBAC 251 Kubernetes Authorization Mechanisms 251 RBAC Overview 252 RBAC Gotchas 253 Avoid the cluster-admin Role 253 Built-In Users and Groups Can Be Dangerous 254 Read-Only Can Be Dangerous 254 Create Pod is Dangerous 256 Kubernetes Rights Can Be Transient 257 Other Dangerous Objects 258 Auditing RBAC 258 Using kubectl 258 Additional Tooling 259 Rakkess 259 kubectl-who-can 261 Rback 261 Summary 262 Chapter 19 Network Hardening 265 Container Network Overview 265 Node IP Addresses 266 Pod IP Addresses 266 Service IP Addresses 267 Restricting Traffic in Kubernetes Clusters 267 Setting Up a Cluster with Network Policies 268 Getting Started 268 Allowing Access 271 Egress Restrictions 273 Network Policy Restrictions 274 CNI Network Policy Extensions 275 Cilium 275 Calico 276 Summary 278 Chapter 20 Workload Hardening 279 Using Security Context in Manifests 279 General Approach 280 allowPrivilegeEscalation 280 Capabilities 281 privileged 283 readOnlyRootFilesystem 283 seccompProfile 283 Mandatory Workload Security 285 Pod Security Standards 285 PodSecurityPolicy 286 Setting Up PSPs 286 Setting Up PSPs 288 PSPs and RBAC 289 PSP Alternatives 291 Open Policy Agent 292 Installation 292 Enforcement Actions 295 Kyverno 295 Installation 296 Operation 296 Summary 298 Index 299

About the Author :
CHRIS BINNIE is a Technical Consultant who has worked for almost 25 years with critical Linux systems in banking and government, both on-premise and in the cloud. He has written two Linux books, has written for Linux and ADMIN magazines and has five years of experience in DevOps security consultancy roles. RORY MCCUNE has over 20 years of experience in the Information and IT security arenas. His professional focus is on container, cloud, and application security and he is an author of the CIS Benchmarks for Docker and Kubernetes and has authored and delivered container security training at conferences around the world.


Best Sellers


Product Details
  • ISBN-13: 9781119782230
  • Publisher: John Wiley & Sons Inc
  • Publisher Imprint: John Wiley & Sons Inc
  • Height: 231 mm
  • No of Pages: 336
  • Returnable: N
  • Weight: 544 gr
  • ISBN-10: 1119782236
  • Publisher Date: 16 Sep 2021
  • Binding: Paperback
  • Language: English
  • Returnable: N
  • Spine Width: 20 mm
  • Width: 185 mm


Similar Products

Add Photo
Add Photo

Customer Reviews

REVIEWS      0     
Click Here To Be The First to Review this Product
Cloud Native Security
John Wiley & Sons Inc -
Cloud Native Security
Writing guidlines
We want to publish your review, so please:
  • keep your review on the product. Review's that defame author's character will be rejected.
  • Keep your review focused on the product.
  • Avoid writing about customer service. contact us instead if you have issue requiring immediate attention.
  • Refrain from mentioning competitors or the specific price you paid for the product.
  • Do not include any personally identifiable information, such as full names.

Cloud Native Security

Required fields are marked with *

Review Title*
Review
    Add Photo Add up to 6 photos
    Would you recommend this product to a friend?
    Tag this Book Read more
    Does your review contain spoilers?
    What type of reader best describes you?
    I agree to the terms & conditions
    You may receive emails regarding this submission. Any emails will include the ability to opt-out of future communications.

    CUSTOMER RATINGS AND REVIEWS AND QUESTIONS AND ANSWERS TERMS OF USE

    These Terms of Use govern your conduct associated with the Customer Ratings and Reviews and/or Questions and Answers service offered by Bookswagon (the "CRR Service").


    By submitting any content to Bookswagon, you guarantee that:
    • You are the sole author and owner of the intellectual property rights in the content;
    • All "moral rights" that you may have in such content have been voluntarily waived by you;
    • All content that you post is accurate;
    • You are at least 13 years old;
    • Use of the content you supply does not violate these Terms of Use and will not cause injury to any person or entity.
    You further agree that you may not submit any content:
    • That is known by you to be false, inaccurate or misleading;
    • That infringes any third party's copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy;
    • That violates any law, statute, ordinance or regulation (including, but not limited to, those governing, consumer protection, unfair competition, anti-discrimination or false advertising);
    • That is, or may reasonably be considered to be, defamatory, libelous, hateful, racially or religiously biased or offensive, unlawfully threatening or unlawfully harassing to any individual, partnership or corporation;
    • For which you were compensated or granted any consideration by any unapproved third party;
    • That includes any information that references other websites, addresses, email addresses, contact information or phone numbers;
    • That contains any computer viruses, worms or other potentially damaging computer programs or files.
    You agree to indemnify and hold Bookswagon (and its officers, directors, agents, subsidiaries, joint ventures, employees and third-party service providers, including but not limited to Bazaarvoice, Inc.), harmless from all claims, demands, and damages (actual and consequential) of every kind and nature, known and unknown including reasonable attorneys' fees, arising out of a breach of your representations and warranties set forth above, or your violation of any law or the rights of a third party.


    For any content that you submit, you grant Bookswagon a perpetual, irrevocable, royalty-free, transferable right and license to use, copy, modify, delete in its entirety, adapt, publish, translate, create derivative works from and/or sell, transfer, and/or distribute such content and/or incorporate such content into any form, medium or technology throughout the world without compensation to you. Additionally,  Bookswagon may transfer or share any personal information that you submit with its third-party service providers, including but not limited to Bazaarvoice, Inc. in accordance with  Privacy Policy


    All content that you submit may be used at Bookswagon's sole discretion. Bookswagon reserves the right to change, condense, withhold publication, remove or delete any content on Bookswagon's website that Bookswagon deems, in its sole discretion, to violate the content guidelines or any other provision of these Terms of Use.  Bookswagon does not guarantee that you will have any recourse through Bookswagon to edit or delete any content you have submitted. Ratings and written comments are generally posted within two to four business days. However, Bookswagon reserves the right to remove or to refuse to post any submission to the extent authorized by law. You acknowledge that you, not Bookswagon, are responsible for the contents of your submission. None of the content that you submit shall be subject to any obligation of confidence on the part of Bookswagon, its agents, subsidiaries, affiliates, partners or third party service providers (including but not limited to Bazaarvoice, Inc.)and their respective directors, officers and employees.

    Accept

    New Arrivals


    Inspired by your browsing history


    Your review has been submitted!

    You've already reviewed this product!