Chapter 18 — Cloud and container security: controls | Technologist Cloud and container security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Control types"]
  N2["18.2 Cobalt's controls"]
  N3["18.3 Framework mapping"]
  N4["18.4 Gaps"]
  N5["18.5 Owners and evidence"]
  N6["18.6 Clients"]
  N7["Testing controls"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Control types"]
  N2["18.2 Cobalt's controls"]
  N3["18.3 Framework mapping"]
  N4["18.4 Gaps"]
  N5["18.5 Owners and evidence"]
  N6["18.6 Clients"]
  N7["Testing controls"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Control types]
    |
    v
[18.2 Cobalt's controls]
    |
    v
[18.3 Framework mapping]
    |
    v
[18.4 Gaps]
    |
    v
[18.5 Owners and evidence]
    |
    v
[18.6 Clients]
    |
    v
[Testing controls]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) describe preventive, detective and corrective controls; (2) map Cobalt's controls; (3) check coverage against a framework.

18.1 Control types

Preventive controls stop problems (admission rules); detective controls find them (logs and scans); corrective controls fix them (rebuild and redeploy). The three control types work together on the same outdated-image risk. For outdated images, the admission rule and the approved registry prevent unapproved images from starting, the nightly inventory and scans detect any that slip through, and the rebuild-and-redeploy process corrects them. If only one type existed, a single failure would leave the risk uncovered. Priya labels every control in her list with one of the three types.

18.2 Cobalt's controls

Approved registry, baseline checks, Pod Security admission, network policies, pipeline checks, audit logs and an advisory process. Each control maps to a type: the approved registry, Pod Security admission, network policies and pipeline checks are mainly preventive; baseline checks, audit logs and the nightly inventory are detective; and the advisory process combines detection with correction through rebuilds. Listing them in one place lets Priya see that corrective controls are thin, apart from rebuilding images. That observation leads her to look for a corrective control for lost data.

18.3 Framework mapping

Priya maps each to CSA CCM v4 domains, such as identity and access management, and to NIST SP 800-190 recommendations on images and registries. The mapping is a table with one row per control and columns for the matching CCM v4 domain, the related SP 800-190 recommendation and the evidence source. It lets an auditor such as Riverside Dental's see Cobalt's controls in a familiar framework without Cobalt adopting the whole framework. Rows with an empty framework column, or framework areas with no control, show where to look for gaps.

18.4 Gaps

The mapping shows no tested restore of client data, which becomes a new task. Backups were being taken, but nobody had restored client data from one, so nobody knew whether a restore would work or how long it would take. The gap matters for availability: a booking system that cannot be restored after a failure leaves patients unable to book. The task is assigned to the platform team and later becomes the restore test that closes a gap in the handoff pack.

18.5 Owners and evidence

Each control has an owner and a source of evidence. The owner keeps the control working and answers questions about it; the evidence source shows that it works. For the baseline check, the owner is the platform team and the evidence is the daily output saved in the repository. For audit logs, the evidence is the log storage itself, along with the alert records. A control without either cannot be shown to an auditor. Owners are named teams, so the record survives staff changes such as Priya's departure.

18.6 Clients

The control list goes into each client's service description. Including the list in the service description tells each client what Cobalt does on their behalf and, by omission, what remains theirs. For Riverside Dental, that means the client sees that Cobalt manages image approval, cluster settings and audit logs, while the dental group still decides which staff may use the booking system. The list is updated whenever a control is added or retired. Clients are told when the list changes, through their account manager's regular service review.

Testing controls

Each control is tested at least once a year: an admission rule is tested by submitting a synthetic non-compliant pod in staging; a log alert by generating a matching synthetic event; the restore by actually restoring. Test results become evidence in the control record, showing not only that a control exists but that it worked recently.

Priya notes that preventive controls are cheapest when they work, but detective and corrective controls are still needed for what prevention misses, such as console changes.

Control owners

Without owners, controls decay. Each control's owner reviews its evidence quarterly.

Client copy

Clients receive a short version of the control list, written without internal detail, describing what Cobalt does for them.

Keeping the map current

When a control changes, its mapping entry and evidence source are updated in the same review.

Worked example

An auditor for Riverside Dental asks how Cobalt prevents unapproved images. Priya shows the admission rule, the pipeline and the inventory check, each with evidence.

Synthetic case. Mapping is synthetic.

Errors and limits

Mapping to a framework shows coverage on paper; testing shows it works.

Exercises

EX052 — Control types. Give one example each of preventive, detective, corrective.
Show marking criteria
Rubric: 3 = admission; logs/scans; rebuild; 2 = two; 1 = one; 0 = none.
EX053 — Mapping gap. What gap did mapping reveal?
Show marking criteria
Rubric: 3 = no tested restore; 2 = partial; 1 = vague; 0 = none.
EX054 — Auditor answer. How did Priya show unapproved images are prevented?
Show marking criteria
Rubric: 3 = admission rule, pipeline, inventory with evidence; 2 = two; 1 = one; 0 = none.

Synthesis

Combine control types, map them and test them.

Continue studying — chapter 18 of 30

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →