DevSecOps in Kubernetes

Chapter 5. Managing Threats

One of the problems that system or application developers contend with is complexity. Any application that does anything of significance is going to be complex because of the sheer number of potential pathways through the application. Once you start moving to a web application deployment model, you may have multiple systems in place, which adds additional complexity. You now have systems with operating systems and applications and services. Even if you are using a cloud native design, you have to deal with virtualized services that may be coming and going. Versioning is a concern because different container instances may have different versions of an application running in them.

All of this is to say that software has to face a lot of potential problems. It all starts with threats—any potential problem or failure that may beset an application, piece of software, or system. This may simply be a result of all the complexity. There is also a possibility of bad data being introduced to a program, causing a failure. That bad data may be a result of a malicious action.

Just having threat information is insufficient. You need to know what you are going to do about these threats. There will always be threats that you won’t be able to do anything about, but it’s best to clearly understand the threat so you can make an informed decision about possible mitigations. Of course, in the case of systems or application development, all of these mitigations should be ...