Automated Risk-Based Security Controls for Vulnerability Detection and Prevention across Cloud-Native Software Development Lifecycles

Abstract

The cloud-native software development has speeded up the delivery of applications using
containers, microservices, Infrastructure as Code, continuous integration, and continuous
deployment, yet it has also made vulnerability detection and security enforcement more
complex. The conventional scanner-based approaches can identify any security
vulnerabilities, yet they can deliver excess results and provide minimal information regarding
authorizing, allowing or disallowing a change. In this paper, a Risk-Adaptive CI/CD Security
Control Orchestration Framework is presented, which uses multi-source security scanning,
policy evaluation, risk scoring based on the context, and automating enforcement across the
lifecycle of cloud-native software development. The proposed framework will employ
solutions like GitHub Actions, Terraform, Kubernetes, Docker, Trivy, semgrep, Open Policy
Agent and Python, to perform a source-code, dependency, container and IaC and
configuration analysis. The risk is determined by the severity, asset criticality, exploitability,
and confidence and is projected to the warning, approval, block, and block-plus-escalation
action as low, medium, high; and critical risk, respectively. It is contrasted with no-
preventive-control implementation and scanner-only implementation in terms of the rate of
detection, false-positive rate, false-negative rate, prevention of risky deployments, CI/CD
overhead, remediation time, and accurate policy decision-making. There is a 94.8 percent
detection rate, 6.3 percent false-positive rate, 5.2 percent false-negative rate, 92.5 percent
risky-deploy blocking, 13.4 percent CI/CD overhead, 48-minute average remediation time,
and the policy decision accuracy of the proposed framework, 93.1 percent, in the illustrative
evaluation. The findings suggest risk-conscious implementation could potentially be applied
to preventive protection with non-selective blocking of deployments. The framework offers a
viable process of trading in the cloud-native security guarantee and agreeable developer
rubbing hands against each other and in incessant software dispatches.