云原生安全白皮书（第二版）

Version: 2.0Created: 12 Jan 2022Status: WIP | In Review |Approved Last Reviewed: 16 May 2022,PDF Published: 17 May 2022Release Version: 2.0 Final PDF Approvers[X] @TheFoxAtWork [X] @justincormack Version 2 (May 2022) •Contributors: Brandon Krieger, Cole Kennedy (TestifySec),Fatih Değirmenci (Ericsson Software Technology), FrederickKautz , Joel Bork, Marina Moore (NYU),mateuszpruchniak@gmail.com, Pushkar Joglekar (VMware),raja.faisal@gmail.com, Savitha Raghunathan (Red Hat),Sayantani Saha (Independent) •Reviewers: Jon Zeolla, @nyrahul (Accuknox), RagashreeShekar, Steven Hadfield, Kapil Bareja, Malini Bhandaru,Mikko Ylinen, Jonah Kowall (@jkowall), Kuang Dahu,ArielShuper, Eric Li (AlibabaCloud), Tanner Randolph (AppliedSystems), Mark Dalton Gray (Microsoft), Ciara Carey,Brandon Lum (TAG Security Chair), Emily Fox (TOC Liaison)and Justin Cormack (TOC liaison). Version2inChinese(September2023) •Translatorand reviewers:@aiaicaow, @babysor, @cafra,@dwctua, @gtb-togerther, @hbrls, @jinjia, @knwng,@losery, @lovepoem, @n3erox0, @rootsongjc, @victorjunlu,@yzyunzhang (GitHub IDs) 目录 执行摘要4 宗旨...................................................................................................................................................4生命周期阶段...............................................................................................................................4推荐做法.........................................................................................................................................6结论...................................................................................................................................................6 介绍7 目标受众.........................................................................................................................................7云原生目标....................................................................................................................................7文档前提.........................................................................................................................................8 云原生层次模型9 生命周期......................................................................................................................................10开发................................................................................................................................................10分发................................................................................................................................................12部署................................................................................................................................................17运行时环境.................................................................................................................................18 安全保障31 威胁建模......................................................................................................................................31用例：勒索软件（v2新增）.............................................................................................35安全原则......................................................................................................................................38安全栈（v2新增）.................................................................................................................44 合规44 监管审计......................................................................................................................................44角色和用例.................................................................................................................................44行业................................................................................................................................................45用例：在欧盟法规下安全的保障金融机构运行v2新增.....................................46 云原生安全的演变48 结论50 缩略语和词汇表51 附录53 版本一总结v2新增................................................................................................................53新版本变化.................................................................................................................................53反馈v2新增...............................................................................................................................53安全软件开发框架（SSDF）v1.1参考（v2新增） ...............................................54参考文献......................................................................................................................................55致谢................................................................................................................................................57 执行摘要 宗旨 技术行业已经转向被看作“云原生”的开发和部署模式。与此同时，技术、产品、标准和解决方案的生态系统正在扩展，促使决策者及时了解最新的复杂设计。特别是CISO的角色，需要在这个动态的领域中阐明业务价值主张。与此同时，云原生模式也推动了消费模型的转变，促进了现代工作流程的应用。现代工作流程要求集成安全实践，例如敏捷方法论和DevOps流程。 问题分析 由于明确关注快速开发和部署，因此该领域内的安全问题很复杂。此外，在传统的基于边界的安全模型中，依赖于网络IP地址等静态标识符是不切实际的。这种复杂性要求我们进行范式转变以保护应用程序安全，放弃基于边界的传统方式，让安全和工作负载（基于标签和标记等属性和元数据进行标识）的联系更加紧密。这种方法可以识别和保护负载，满足