What new security practices or tools have you implemented to address challenges related to microservices or serverless computing?
Sort by:
For microservices and serverless computing, which is primarily cloud-based, we utilize CNAPP for cloud workload protection. This includes scanning and making sure that serverless code permissions are practical and limited to necessary access. We carefully monitor and restrict access boundaries within our cloud environments.
Our focus is on API security, utilizing tools like Salt Security to keep our APIs protected. We also prioritize container security by regularly scanning containers and maintaining updated golden images for secure computing needs. We also employ various CI/CD pipeline tools to integrate security throughout the lifecycle, adopting a shift-left strategy to proactively address security concerns. This includes code scanning and monitoring deployments for comprehensive security.
While I can't discuss specific tools, our approach is similar to your organization’s. We aim to secure the entire lifecycle of serverless applications, focusing on architecture, visibility, and continuous monitoring. Inline scanning and other security measures are integral to our strategy.
In addition to major players, there are Kubernetes-specific security solutions like Rad Security that delve into attack surface management for microservices and serverless computing. Identity management also plays a crucial role in this security landscape.