How Can We Fill the Security Gaps in the Era of Hybrid Cloud?

As digital transformation accelerates, corporate infrastructure is rapidly evolving beyond physical servers to public cloud, containers, and serverless environments. Alongside this shift, the security paradigm is also undergoing a major transformation. In particular, with the widespread adoption of microservices architecture (MSA) and container-based cloud-native environments, attack methods have become more sophisticated, and security operations have grown increasingly complex.

Evolution of Cloud Architecture: The Expansion of Serverless and Hybrid Environments

Cloud infrastructure has evolved from physical servers to virtualization, public cloud, cloud-native platforms, and now to serverless pods. This transformation is not merely a shift in environment, as it also demands a fundamental redefinition of traditional perimeter-based security strategies.

(1) Propagation of cloud-native environments based on microservices architecture

Microservices Architecture (MSA), which breaks down large-scale applications into function-specific, independently operated components, enhances adaptability to change and scalability. Most are containerized, and orchestration using Kubernetes has become standard practice.

(2) Kubernetes, the standard for container-based operations

Kubernetes is an orchestrator that automates the distribution, scaling, and recovery of containers, enabling seamless service operation in cloud-native environments. With features like node status monitoring, resource-optimized scheduling, and rolling updates, it maximizes operational efficiency across large-scale infrastructure.

(3) Expansion of serverless pods and hybrid cloud

Serverless pod environments like AWS Fargate and Alibaba ACK Serverless allow containers to run automatically just by defining the container image, without any infrastructure setup. While this reduces operational complexity, it also limits security control, necessitating a new approach to security design.

In addition, hybrid cloud strategies that combine on-premises systems, public/private cloud, and serverless environments enable flexible workload placement based on sensitivity, performance, and regulatory requirements. However, if the security strategy lacks consistency across these environments, critical security gaps may arise.

In addition, hybrid cloud strategies that combine on-premises systems, public/private cloud, and serverless environments enable flexible workload placement based on sensitivity, performance, and regulatory requirements. However, if the security strategy lacks consistency across these environments, critical security gaps may arise.

 

Figure 1. Step-by-step flow of cloud migration and cloud-native transition

 

Sophisticated Cloud Threats: Real-World Penetration Scenarios

AhnLab set up a public cloud environment in the AWS Seoul region and operated honeypot systems for two weeks to capture real-time attack patterns. As a result, over 1.8 million attacks were detected, and 16 out of the 23 honeypots experienced continuous attacks.

Main Attack Flow

(1) SSH brute force intrusion and CoinMiner installation

A brute force login attack is launched against SSH port 22, and upon successfully compromising the root or admin account, a CoinMiner is installed. The malicious script is hidden in temporary directories such as /tmp and /dev/shm, and persistence is maintained by registering with systemd. The attacker then conducts internal scanning and lateral movement to spread the infection to other servers, ultimately encrypting key directories with ransomware.

Figure 2. Initial breach via SSH brute force attack

 

(2) Breach of cloud management platform

Attackers access management platforms such as OpenStack and Proxmox via web UI or SSH to exfiltrate the root account and collect authentication data using tools similar to Mimikatz. The attack then escalates by encrypting VM images (.qcow2, .vmdk), effectively crippling the entire cloud environment.

Figure 3. Multi-stage breach attempt targeting cloud management systems

 

(3) Propagation of cross-platform malware

Malware that leverages universal runtimes such as Go, .NET Core, and PowerShell Core is on the rise, enabling simultaneous infection across multiple operating systems including Windows, Linux, and macOS. Notable examples include GravityRAT, RansomExx, and PLEAD.

 

(4) Attacks on container environment

There have been many cases where exposed vulnerabilities in the Docker REST API (2375, 2376) were used for remote command execution. These vulnerabilities are used to download malicious images, hijack containers, mine cryptocurrency, and conduct DDoS activities. Some attackers also attempt to bypass container isolation and escalate privileges on the host system by exploiting the runc vulnerability (CVE-2019-5736).

 

AhnLab's Cloud Security Strategy: Integration and Real-Time Response

AhnLab provides an integrated cloud workload security strategy that spans host, container, and serverless pod environments.

 

• Host Security: Anti-malware, HIPS, application control, and integrity monitoring
• Container Security: Cluster visibility, image vulnerability, malware detection, and anti-malware/HIPS using the DaemonSet method
• Serverless Pod Security: IDS and firewall detection using the Sidecar method designed for environments where agent installation is not possible

Figure 4. Cloud transition, native architecture change, and security requirements

(1) Unified security approach for hybrid cloud

As most companies shift to hybrid cloud environments, security must also be approached from a unified perspective. AhnLab proposes a security strategy capable of protecting both host operating systems and containers simultaneously.

For physical servers and cloud hosts, foundational security measures like malware detection, host-based intrusion prevention, application control, and integrity monitoring must be implemented alongside monitoring and control of resource usage.

In addition, securing container workloads requires image vulnerability management, runtime protection, and a threat detection and response system.

In Kubernetes environments, node-level security distribution through DaemonSets is essential, while in serverless architectures, security functions must be integrated in the form of sidecar patterns. AhnLab addresses these needs with a multi-layered security strategy that covers worker nodes, containers, and serverless workloads.

 

(2) Enhancing workload security based on container images

In cloud-native environments, securing the code at the development stage is important, but understanding and managing which images are actually running in distributed containers is critical to operational security.

AhnLab identifies the base images of actively running containers and scans them for vulnerabilities and malware.

The analysis results are visualized along with information such as which services, which clusters, and how many workloads the image is distributed to, and response priorities are suggested based on the actual risk level in the live environment.

By focusing on the operational environment, AhnLab strengthens container security not just from a development perspective, but from a workload-centric threat exposure standpoint.

 

(3) Ensuring Kubernetes infrastructure visibility and real-time response

A lack of visibility into container-based infrastructure poses a significant challenge for security administrators. To address this, AhnLab offers a container security solution that provides a Kubernetes topology view along with resource-level threat detection.

This enables real-time insight into which resources within the cluster are exposed to which threats, allowing for comprehensive response capabilities, including image vulnerability and malware detection.

Figure 5. AhnLab CPP unified lineup for cloud workload security

 

Strengthening Cloud-Native Security: AhnLab CPP Container Security Lineup

AhnLab offers a unified cloud security platform called "AhnLab CPP" to put this security strategy into practice. Recently, AhnLab further enhanced its cloud-native security capabilities by launching a new container security lineup.

In April, AhnLab released an expanded lineup that extends security coverage to Kubernetes and serverless environments. This allows for consistent security policy enforcement and agile threat response across a wide range of cloud infrastructures.

 

Customers can take a closer look at the specific cloud security benefits they can expect with the latest updates to AhnLab CPP.

 

1. Anti-malware for Container: Runtime security specialized for Kubernetes environments

Anti-malware for Container (AMC) is a dedicated anti-malware solution designed to detect and respond to malicious activity occurring within running containers in real time on Kubernetes-based containers. Unlike traditional image-level checks, this solution is designed to detect and defend against threats inside running containers in real time, using a distribution method optimized for Kubernetes environments.

 

AMC supports major node-based platforms such as Self-managed Kubernetes, Amazon EKS, and Alibaba Cloud ACK, enabling the establishment of a continuous and agile security operation system even in environments where containers are rapidly created and terminated. This allows companies to expand their security coverage while also gaining real-time threat response capabilities optimized for the characteristics of cloud environments.

 

• Supported Environments: Self-managed Kubernetes, Amazon EKS, Alibaba Cloud ACK
• Application Method: Distribute Kubernetes DaemonSet

 

2. Host IDS/IPS Expansion: Closing security blind spots in serverless environments

The Host IDS/IPS features previously available only on traditional hosts have now been extended to cover Kubernetes and serverless pod environments. These features provide consistent detection and security visibility even in environments where direct access to the operating system is limited.

 

In Kubernetes environments, security features are distributed as DaemonSet pods, and IDS, IPS, and firewall are provided in user mode. These can be utilized across major cloud platforms such as Self-managed Kubernetes, AWS (EKS), and Alibaba Cloud (ACK).

 

In serverless pod environments, it's distributed in the form of sidecar containers, with IDS and firewall features provided in detection mode (monitoring-focused). This consistent security approach can be applied across various serverless platforms, including AWS (Amazon EKS on Fargate, ECS on Fargate) and Alibaba Cloud (ACK Serverless, ECI).

*Sidecar Container: A container deployed within the same pod as the main application container. It operates independently while supporting the main container

 

This platform expansion enables the AhnLab CPP product line to support consistent policy enforcement and operational convenience across the entire cloud environment, offering a practical and flexible security alternative for companies considering the implementation of serverless.

 

With this expansion of container security features, AhnLab CPP now provides unified protection for hosts, containers, and serverless pod environments, all managed from a single management server. Existing CPP-based policies can be extended without additional training or configuration changes, enabling seamless security operations and consistent policy application even in complex cloud environments.

Figure 6. Security requirements by cloud infrastructure environment and AhnLab CPP response system

 

Through the enhancement of AhnLab CPP, AhnLab helps customers maintain consistent security policies and maximize their threat response capabilities, even as they transition to and expand their cloud infrastructure. Going forward, AhnLab will continue to introduce security features optimized for a wide range of cloud workloads, further strengthening its role as a trusted partner in supporting customers' stable digital transformation.

 

For more information about AhnLab CPP, please visit the AhnLab website.

 

▶ Go to AhnLab CPP product information page