How security can keep pace with continuously evolving cloud-native applications

The talk looks at a trend where cloud application architectures change release over release, sometimes sprint over sprint, because infrastructure is now written as code in tools such as Terraform and CloudFormation. Ownership of that code is shifting to development teams, and the speaker notes that security reviews often fall out of date before a design ships. Cloud providers also release features quickly, sometimes before their security controls are complete.

The middle of the talk covers responses. Security teams are advised to make guidance accessible to developers through training, to build reusable design patterns as Terraform templates, and to take part in design and threat modeling early. Automation is presented as the way to scale small teams: scanning infrastructure code in the pipeline, reporting the reason for each finding and the specific setting to change, and detecting drift between code and deployed resources. Restricting console and CLI changes so the pipeline is the only path is described as the most effective control, with break-glass access needed during incidents.

A live demo runs a scanning integration in GitHub Actions against a small Terraform project containing an API gateway, a Lambda function, S3 buckets and a KMS key. After a Kinesis stream and SQS queue are added from a public example, the scan flags key management gaps and explains how to fix them. The speaker closes by showing how changing a data-sensitivity attribute can raise requirements as a prototype matures, and urges combining training, patterns, automation and feedback loops.