Code-to-cloud contextualization

As explained in Azure Security

Code-to-cloud contextualization is the correlation of software code and development findings with the cloud resources and runtime context they affect.

Code-to-cloud contextualization connects DevOps repository findings with cloud security posture management so teams can prioritize misconfigurations according to the resources and business effects they may affect. section 11.4 section 11.4.9

The approach enables security teams to:

• View repository vulnerabilities, secrets, and misconfigurations inside the Defender for Cloud dashboard. section 11.4
• Use Cloud Security Explorer to relate repositories and cloud resources through graph-based queries. section 11.4.9
• Determine which resources are exploitable and assess the resulting business effect. section 11.4.9

Figure 11.11 Defender for DevOps integration with Cloud Security Explorer

Use the integration diagram to trace how Defender for DevOps findings become queryable in Cloud Security Explorer. section 11.4.9

Internet-accessible repositories

Onboard repositories to Defender for DevOps, then write a Cloud Security Explorer graph query to determine whether any repositories are accessible to the internet. section 11.4.9

How Azure Security covers it

How deep it goes

Explains the Defender for DevOps–CSPM integration and graph queries, but does not detail query construction or correlation internals.

Examples

Uses Cloud Security Explorer to query whether repositories are accessible to the internet.

What it assumes

Assumes repositories are onboarded to Defender for DevOps and the environment is available through Defender for Cloud.

What you can do after

Diagnose repository-related cloud exposure with Cloud Security Explorer by identifying exploitable resources and business effects.

How it connects

Connects Defender for DevOps, Defender for Cloud, cloud security posture management, repositories, and Cloud Security Explorer.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Microsoft Defender for DevOpsuses · Microsoft Defender for DevOps is a Microsoft security service that provides security visibility and protection across DevOps environments and pipelines.
• cloud security posture managementuses · Cloud security posture management is the continuous assessment of cloud workloads and configurations against security requirements, with guidance for correcting weaknesses and misconfigurations.
• zero-day vulnerabilityaddresses · A zero-day vulnerability is a security flaw unknown to its responsible party or lacking an effective available fix when exploitation or disclosure occurs.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.