The Core of Cloud-Native Security: A Practical Guide to CNAPP Integration

Financial sector security teams operating large-scale cloud environments are confronted with constantly evolving threats and complex regulatory compliance requirements. As the depth of the cloud-native technology stack increases, encompassing services from various cloud providers such as AWS, Azure, and GCP, alongside Kubernetes clusters, serverless workloads, and container image management, security architecture design becomes increasingly intricate. In such an environment, security teams are challenged with maintaining a robust security posture without impeding development velocity and ensuring integrated visibility across all cloud resources. The ultimate objective is to eliminate security blind spots arising from cloud complexity, bolster threat detection and response capabilities, and maximize operational efficiency.

From an architectural perspective, the rapid expansion of cloud environments clearly exposes the limitations of traditional on-premise security models. Numerous cloud resources, dynamically created and ephemeral workloads, and distributed development and deployment pipelines are challenging to protect effectively with traditional perimeter-based security approaches. A practically significant consideration is that managing disparate security settings and compliance requirements individually for each cloud service is inefficient and highly susceptible to human error. To resolve these challenges and enhance the maturity of cloud security, an integrated and automated approach is considered essential.

The Reality of Cloud Security: Challenges Faced

Based on operational experience, many organizations confront the following key security challenges in cloud-native environments. First, fragmented security visibility. As various point solutions such as CSPM (Cloud Security Posture Management), CWPP (Cloud Workload Protection Platform), CIEM (Cloud Infrastructure Entitlement Management), KSPM (Kubernetes Security Posture Management), and SAST/DAST/SCA in the development phase operate in silos, obtaining a unified security situational awareness across the entire cloud environment becomes difficult. This leads to significant time consumption for threat detection and analysis, and results in complex incident response processes.

Second, manual and inefficient compliance management. In regulated industries such as the financial sector, compliance with numerous standards like GDPR, PCI DSS, ISMS-P, and SOC 2 is required. However, due to the dynamic nature of cloud resources, relying solely on manual audits and report generation makes it challenging to ensure continuous compliance. Configuration errors and misconfigurations constantly occur, and automated mechanisms to detect and rectify them in real-time are often absent.

Third, conflict between development velocity and security. Despite aiming for DevSecOps, security verification processes frequently act as bottlenecks in the CI/CD pipeline. When the Shift-left security principle of identifying and rectifying security vulnerabilities early in the development phase is not adequately implemented, vulnerabilities discovered late in the operational phase lead to deployment delays and additional costs. Furthermore, there is a deficiency in the capability to address cloud-native specific security requirements, such as vulnerability management within container images and IaC (Infrastructure as Code) security validation.

Fourth, complexity of threat detection and response. To effectively counter new attack vectors and zero-day threats in cloud environments, sophisticated runtime protection and real-time threat intelligence are essential. However, traditional SIEM/SOAR solutions often struggle to immediately identify subtle anomalies or attack attempts occurring in cloud-native environments. To overcome these challenges, a new security strategy that thoroughly understands and integrally approaches the characteristics of cloud-native environments is required.

CNAPP: A Strategic Choice for Cloud-Native Security

To address the challenges encountered, the team reviewed various technological approaches. Initially, leveraging built-in security services from each cloud provider (e.g., AWS GuardDuty, Azure Defender, GCP Security Command Center) and supplementing deficiencies with open-source or individual point solutions were considered. However, difficulties in applying consistent security policies across multi-cloud environments and the complexity of data integration and interoperability between solutions posed significant limitations. Reviewing individual dashboards and analyzing numerous alerts increased the operational burden on security teams and hindered the achievement of true integrated visibility.

From an architectural perspective, cloud-native environments necessitate a security model organically connected throughout the entire lifecycle, from development to operations. What was required was not merely a compilation of security features, but a platform capable of integrated visibility, continuous compliance management, and automated threat detection and response across the entire Code to Cloud spectrum. Based on these criteria, a comparative analysis of various candidate technologies and solutions led to the conclusion that CNAPP (Cloud Native Application Protection Platform) represents the most suitable approach. CNAPP was evaluated as the optimal solution, offering core cloud-native security elements such as CSPM, CWPP, CIEM, KSPM, and DR (DevOps Security) as a single integrated platform, thereby overcoming the limitations of siloed security tools and enabling End-to-End security implementation.

Specifically, an integrated platform such as SeekersLab's FRIIM CNAPP supports multi-cloud environments and provides capabilities to effectively implement Shift-left security through integration with the development pipeline. The selection criteria were as follows:

• Integrated Visibility: Provision of a single unified view for all cloud resources and workloads.
• Automation Capabilities: Automation of policy violation detection, vulnerability scanning, and compliance assessment.
• Multi-cloud Support: Consistent security application across various cloud environments such as AWS, Azure, and GCP.
• DevSecOps Integration: Embedding security verification stages within the CI/CD pipeline.
• Scalability: Flexible response to new cloud services and workload types.
• Total Cost of Ownership (TCO) Efficiency: Potential for reduced management and operational costs compared to deploying individual solutions.

When these aspects were comprehensively considered, the most strategic choice for effectively managing the complexity and interconnectedness of cloud-native environments and maximizing the operational efficiency of security teams was determined to be the CNAPP integration approach.

CNAPP Integration Implementation Process

A practically significant point is that CNAPP integration extends beyond merely adopting a solution; it necessitates changes across the organization's cloud architecture and development processes. The team established an integrated security environment centered around FRIIM CNAPP following these steps.

1. Initial Architecture Design and Agent Deployment

First, the architecture was designed to enable FRIIM CNAPP to acquire access privileges for all resources and collect data across the entire cloud environment. Access was configured based on the principle of least privilege, utilizing AWS IAM Roles, Azure Service Principals, and GCP Service Accounts. For Kubernetes clusters, FRIIM CNAPP agents were deployed as DaemonSets to collect runtime information from all nodes and Pods. In VM (Virtual Machine) environments, host-based agents were installed to ensure visibility.

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: friim-cnapp-agent
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: friim-cnapp-agent
  template:
    metadata:
      labels:
        name: friim-cnapp-agent
    spec:
      hostNetwork: true
      hostPID: true
      hostIPC: true
      tolerations:
      - operator: Exists
      serviceAccountName: friim-cnapp-sa
      containers:
      - name: agent
        image: seekerslab/friim-cnapp-agent:latest
        securityContext:
          privileged: true
        env:
          - name: FRIIM_ACCOUNT_ID
            value: "your_seekerslab_account_id"
          - name: FRIIM_CLUSTER_NAME
            value: "your_k8s_cluster_name"
        volumeMounts:
          - name: docker-sock
            mountPath: /var/run/docker.sock
          - name: sys-root
            mountPath: /host/root
            readOnly: true
          - name: dev
            mountPath: /dev
          - name: var-lib-docker
            mountPath: /var/lib/docker
      volumes:
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
        - name: sys-root
          hostPath:
            path: /
        - name: dev
          hostPath:
            path: /dev
        - name: var-lib-docker
          hostPath:
            path: /var/lib/docker

The YAML configuration above is an example of deploying a FRIIM CNAPP agent as a DaemonSet in a Kubernetes environment. Agents are deployed on all nodes to access the host network and file system, and are configured to monitor container runtime events and system calls. During this process, the necessary IAM roles and service account permissions were carefully defined according to the principle of least privilege.

2. Achieving Visibility Based on CSPM and CIEM

By utilizing FRIIM CNAPP's CSPM capabilities, the resource configuration status of all registered cloud accounts was continuously assessed. Compliance violations were automatically detected and reports generated in accordance with major regulatory and security standards such as CIS Benchmarks, NIST CSF, and ISMS-P. Special focus was placed on identifying and rectifying critical configuration errors, such as unused accounts, excessive privilege grants, and publicly exposed storage buckets, based on priority. Through CIEM capabilities, IAM roles and RBAC policies assigned to cloud accounts and workloads were analyzed to identify violations of the Least Privilege principle and detect abnormal attempts to use privileges.

3. Enhancing Workload Protection through CWPP

Cloud workload protection focused on container image vulnerability scanning and runtime protection. FRIIM CWPP was integrated into the CI/CD pipeline, configured to automatically perform vulnerability scans using tools like Trivy or Clair whenever a new container image was built. In the event of critical vulnerabilities being discovered, deployments were automatically blocked or alerts were generated to notify the development team immediately. Furthermore, within Kubernetes clusters, Falco-based runtime security policies were applied to activate features that detect and block abnormal process executions, file accesses, and network communications in real-time. This contributed to continuously assessing and improving the cluster's security posture in conjunction with KSPM (Kubernetes Security Posture Management) capabilities.

# Falco Rule 예시: 컨테이너 내부에서 Shell 실행 시 경고
- rule: "Run shell in container"
  desc: "Detects when a shell is run in a container"
  condition: >
    spawned_process and container and proc.name in (shell_binaries) and not proc.pname in (allowed_container_parents)
  output: "Shell spawned in container (user=%user.name container=%container.name process=%proc.name cmdline=%proc.cmdline parent=%proc.pname %container.id)"
  priority: CRITICAL
  tags: [container, shell, MITRE_ATTACK_T1059]
  source: syscall

The Falco Rule example above illustrates a configuration that generates a critical (CRITICAL) alert when a shell is executed inside a container. By integrating such rules into FRIIM CWPP, sophisticated control and threat detection for cloud runtime environments were implemented.

4. DevSecOps Pipeline Integration and Automation

To implement Shift-left security, efforts focused on embedding security from the development phase. FRIIM CNAPP's scanning capabilities were integrated into the CI/CD pipeline to automatically detect potential security vulnerabilities and configuration errors by scanning IaC (Infrastructure as Code) files (Terraform, CloudFormation templates) and application code with every commit to the Git repository. For instance, static analysis and IaC scanning steps were added to GitHub Actions or GitLab CI/CD scripts, enabling developers to identify and rectify security issues early. This approach minimized the introduction of vulnerabilities into the production environment and significantly reduced the time and cost associated with security patching.

# GitHub Actions Workflow 예시: IaC 스캔 및 컨테이너 이미지 스캔
name: DevSecOps Pipeline
on:
  push:
    branches:
      - main
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    - name: Run FRIIM CNAPP IaC Scan
      run: |
        pip install friim-cli
        friim iac scan --path ./terraform --format json > iac-report.json
        # Add logic to fail build if critical issues found
    - name: Build & Push Docker Image
      uses: docker/build-push-action@v4
      with:
        context: .
        push: false
        tags: my-app:latest
    - name: Run FRIIM CNAPP Image Scan
      run: |
        friim image scan --image my-app:latest --format json > image-report.json
        # Add logic to fail build if critical vulnerabilities found

This Bash script is a simple example of performing IaC scanning and container image scanning using FRIIM CLI in a CI/CD pipeline. In a real-world environment, automation can be enhanced by adding build failure conditions based on report results or including logic to send results to the FRIIM CNAPP dashboard.

5. Integrated Threat Detection and Response Automation

All security alerts detected by FRIIM CNAPP were integrated in real-time into Seekurity SIEM and managed centrally. This enabled the cross-correlation analysis of all security events occurring in the cloud environment, such as configuration errors, vulnerabilities, runtime threats, and identity/access privilege anomalies, within a single platform. Seekurity SIEM's robust correlation analysis engine contributed to effectively identifying complex attack scenarios. Furthermore, playbooks were established utilizing Seekurity SOAR to automatically respond to specific types of threats. For instance, if a storage bucket containing sensitive data was exposed externally, or an abnormal login attempt was detected, actions such as automatically blocking access to the resource, sending notifications to the responsible personnel, and resetting the password of the related account were automated.

Concurrently, KYRA AI Sandbox was utilized for in-depth analysis of zero-day threats or suspicious files. High-risk files or URLs detected by FRIIM CNAPP or Seekurity SIEM/SOAR were automatically forwarded to KYRA AI Sandbox, undergoing realistic behavioral analysis in an isolated virtual environment. This enabled the identification of malicious behavior patterns difficult to discern through static analysis alone, and the acquisition of additional intelligence on new threats, thereby enhancing the defense posture. This comprehensive process played a decisive role in innovatively improving the efficiency and response speed of cloud security operations.

Results and Achievements: Proving the Value of Integrated Security

The establishment of an integrated security platform centered around FRIIM CNAPP yielded significantly greater results than anticipated. Quantitatively, the security configuration assessment cycle for cloud resources transitioned from a weekly manual review to real-time continuous monitoring. This resulted in an average compliance score improvement of over 20% and a reduction of approximately 30% in the number of critical vulnerabilities discovered at the time of new cloud resource deployment. Furthermore, the average time spent on security event analysis was reduced from tens of minutes to within minutes, and automated responses through Seekurity SOAR led to a more than 50% faster incident resolution time.

Qualitative achievements are also notable. Security teams experienced a significant reduction in operational fatigue as they no longer needed to manually collect data by navigating fragmented consoles, but could rather ascertain the entire cloud security posture from a single FRIIM CNAPP and Seekurity SIEM dashboard. Collaboration with development teams was also substantially enhanced. Thanks to integrated security verification within the CI/CD pipeline, a culture of identifying and rectifying security vulnerabilities early in development was established, leading to reduced unnecessary friction between development and security and overall improved development productivity. Shadow IT issues were largely mitigated due to integrated visibility, and a foundation was laid for effectively applying Zero Trust principles in the cloud environment.

These results clearly demonstrate that CNAPP integration played a pivotal role in comprehensively transforming the organization's security culture and operational efficiency, beyond mere technical improvements.

Lessons Learned and Retrospection: The Path of Continuous Improvement

During the CNAPP integration project, what differed from expectations was that initial data integration and harmonization with the existing security culture required more time and effort than anticipated. Particularly, the standardization of data formats and definition of parsing rules proved complex during the integration of various cloud service logs and metadata into Seekurity SIEM. Furthermore, there was some initial resistance during the process of embedding security verification stages into the development team's existing workflows. However, by understanding the development process, providing practical feedback, and incrementally guiding changes, the security team successfully achieved adoption.

If such a project were to be undertaken again, it would commence from the initial stage by clearly sharing the objectives and expected benefits of CNAPP adoption through workshops with development team leaders and key stakeholders, and by building small success experiences through a PoC (Proof of Concept). This would significantly contribute to fostering internal consensus regarding the change and reducing trial and error during the adoption process. An unexpected ancillary benefit was the remarkable improvement in security team members' understanding of the cloud-native technology stack, which served as an impetus for strengthening proactive prediction and response capabilities against new types of threats that may arise in cloud environments. Furthermore, by experiencing the identification of early signs of zero-day threats, which were previously difficult to detect, through KYRA AI Sandbox, the team realized the potential of AI-driven security analytics.

These lessons serve as a reminder that cloud security is not a one-time project but a journey of continuous improvement. Technology adoption is merely the beginning; true efficacy can only be achieved when accompanied by changes in culture and processes. A robust and flexible cloud security framework will only be completed when continuous monitoring, feedback integration, and learning about the latest threat trends are concurrently pursued.

CNAPP Adoption: A Guide for Successful Cloud-Native Security

For organizations considering CNAPP adoption in similar cloud environments, several key application guidelines are presented. First, establish a phased adoption roadmap. Rather than attempting to integrate all functionalities at once, it is effective to start with gaining visibility and improving compliance through CSPM, then extend to workload protection via CWPP, and finally, progress to DevSecOps integration and automated threat response. SeekersLab's FRIIM CNAPP flexibly supports such a phased approach.

Second, establishing a culture of close collaboration between security and development teams is an essential prerequisite. As CNAPP embeds security throughout the development pipeline, successful implementation is challenging without the active participation and understanding of the development team. Regular workshops and feedback sessions are crucial for enhancing mutual understanding and establishing common goals. Third, the principle of 'Security as Code' must be actively embraced. Consistency and efficiency can be achieved by managing and automating security policies and configurations as code. Finally, continuous monitoring and improvement are paramount. As cloud environments constantly evolve, security policies must be periodically reviewed and optimized based on the data provided by CNAPP. Integrating and analyzing detected threat data with Seekurity SIEM/SOAR, and utilizing KYRA AI Sandbox to prepare for new threats, will form the foundation for continuously strengthening the security posture. This approach will contribute to effectively managing the complexity of cloud-native environments and establishing a robust defense system against unpredictable future threats.

Initiate Your Cloud Security with FRIIM CNAPP

FRIIM CNAPP
An integrated security platform that protects the entire cloud-native environment, from development to operations. Manage CSPM, CWPP, and CIEM on a single platform.
Learn more about FRIIM CNAPP →