A software company hosts a critical customer service portal on a Managed Kubernetes platform (PaaS). The cloud service provider (CSP) maintains the master control plane, hypervisor infrastructure, and worker node operating system updates. During a recent vulnerability scan, security auditors identified critical security flaws in the application runtime dependencies packaged inside the deployment container images. Which of the following actions represents the customer's responsibility under the cloud shared responsibility model to remediate these vulnerabilities?
- Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.Answer
- BSubmit an urgent support request requiring the cloud provider to patch the vulnerable application runtime libraries on the running containers.
- CConfigure an edge perimeter firewall rule to trust all internal container worker node traffic automatically without further inspection.
- DReclassify the application container libraries as physical infrastructure controls covered under the provider's compliance attestation.
Answer
Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.
Under the cloud shared responsibility model for Platform as a Service (PaaS) and managed container environments, the cloud service provider manages physical infrastructure, hypervisors, and the container engine/node operating system. However, the customer is strictly responsible for securing everything inside their container images, including custom application code, third-party libraries, and dependencies. Scanning container images within the CI/CD pipeline ensures vulnerable dependencies are identified and updated by the customer before deployment.
Step-by-Step Solution
Key Concept
Cloud Shared Responsibility Model in Managed Platform Services
Estimated Time:1m 30s