Securing Cloud-Native Applications

Securing a cloud-native application is fundamentally different from securing a server-room monolith. The attack surface is larger, the dependencies are deeper, the credentials are everywhere, and the perimeter is fluid. Modern application security is defense in depth at every layer.

This lesson covers the security concerns specific to cloud-native SaaS: application-level attacks, supply chain, secrets, runtime, and the zero-trust model that ties it all together.

Defense in Depth

The principle: multiple layers of independent security, so a single failure doesn’t cascade.

┌──────────────────────────────────────────────────────────┐
│  Edge:  WAF, DDoS protection, rate limiting              │
├──────────────────────────────────────────────────────────┤
│  Network:  TLS, mTLS between services, network policies  │
├──────────────────────────────────────────────────────────┤
│  Identity:  OAuth/OIDC, MFA, RBAC, tenant isolation      │
├──────────────────────────────────────────────────────────┤
│  Application:  Input validation, SQL injection prevention│
├──────────────────────────────────────────────────────────┤
│  Data:  Encryption at rest, key management, RLS          │
├──────────────────────────────────────────────────────────┤
│  Audit:  Access logs, anomaly detection, IDR             │
└──────────────────────────────────────────────────────────┘

Each layer catches what others miss. Strong identity doesn’t help if SQL injection lets attackers bypass the app entirely. Encryption at rest doesn’t help if logs leak plaintext PII. Apply security at every level.

OWASP Top 10

The industry-standard list of most-impactful web application security risks. Worth knowing every one:

Input Validation and Output Encoding

The single most effective defense against injection.

# Wrong — SQL injection vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"

# Right — parameterized
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

# Wrong — XSS vulnerable
return f"<div>Hello {name}</div>"

# Right — escape HTML
return f"<div>Hello {html.escape(name)}</div>"

Supply Chain Security

Modern apps have hundreds or thousands of transitive dependencies. Each is a potential vulnerability.

Secrets Management

Secrets — API keys, DB passwords, certs, encryption keys — are the keys to the kingdom. Treat them carefully.

The right way

Container and Runtime Security

For containerized SaaS:

Zero Trust

The traditional security model assumed inside-the-network = trusted. Cloud-native and remote work broke that assumption. Zero trust says: verify everything, regardless of network position.

Network Security in Cloud-Native

Security Headers

A few HTTP headers that meaningfully reduce attack surface:

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-...'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()

These headers prevent classes of attacks (clickjacking, MIME sniffing, mixed content). Set them at the edge or framework level.

Audit Logging

Every privileged action should be logged with enough context to reconstruct it later.

Audit logs should be:

• Immutable — write-only. Append to S3 with object lock, or stream to a SIEM.
• Tamper-evident — even admins can’t silently modify audit history.
• Retained for the required compliance window (e.g., 1 year, 7 years for some regulations).

Recap

• Defense in depth: multiple independent layers, so one failure doesn’t cascade.
• Know the OWASP Top 10. Especially A01 (access control) and A03 (injection) — most common, most impactful.
• Validate input at the boundary; encode output for the destination. Prevents injection.
• Supply chain: SBOMs, vulnerability scanning, lock files, signed artifacts.
• Secrets: centralized store (Vault, Secrets Manager), automatic rotation, no long-lived credentials.
• Containers: scan images, minimal base, non-root user, read-only FS, Pod Security Standards.
• Zero trust: identity everywhere, least privilege, audit everything.
• Security headers reduce attack surface for free.
• Audit logs: immutable, tamper-evident, retained for compliance.