TM1: Security Big Picture

Asset Profile

Time Estimate: 30 Minutes Focus: Minimum Requirements & SKE Governance Learning Goals: * Understand the Shared Responsibility Model at STACKIT. * Get an overview of the defense lines (Build, Network, Runtime).

1. Motivation: Why Cloud Security is Different

Unlike traditional on-premise environments (“Boundary Security”), the cloud operates on the Shared Responsibility Model:

• STACKIT Responsibility: Security of the Cloud (Data centers, Hardware, Host OS).
• User Responsibility: Security in the Cloud (Network config, Encryption, App Security, Data).

---

2. The Security Big Picture (Lines of Defense)

A. Build (Shift Left)

Code & Supply Chain Security * 4-Eye-Principle: Mandatory reviews for every Pull Request. * Vulnerability Scanning: Using Snyk to identify vulnerabilities in libraries.

B. Network

ACLs & Encryption * SKE ACLs: Strictly restrict access to the Control Plane (No 0.0.0.0/0!). * TLS & Ingress: Certificate management via Cert-Manager for all entry points.

C. Runtime

Runtime Security & Zero Trust * SentinelOne: EDR protection directly on the Kubernetes nodes. * ‘Istio’ (Service Mesh): mTLS for encrypted pod-to-pod communication and Zero Trust enforcement.

---

3. Modular Pipeline Concept for Security

Security is defined as code and rolled out automatically:

1. Templates: Integration of pre-built security modules in the CI/CD pipeline.
2. Secrets Manager: Secure credential retrieval via Hashicorp Vault. 3. Automated Guardrails: Temporary opening and automatic resealing of ACLs during deployment.

---

4. Reference Matrix

Swipe sideways to see the whole table

Layer	Measure	Policy / Tool
Code	Snyk, Reviews	Vulnerability Management
Control Plane	STACKIT SKE ACLs	SKE Access Control
Network	TLS, mTLS	Cert-Manager / Istio
Workload	SentinelOne	Endpoint Protection