Security in Cloud Computing Environments in 2023: Integration of CNAPP, Observability with eBPF, and Emerging Generative AI Risks

1. Introduction

Cloud computing has established itself as a fundamental infrastructure for contemporary digital systems. Organizations across various sectors have migrated critical workloads to platforms such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), driven by scalability, elasticity, and operational efficiency. However, this transformation has also introduced substantial security challenges, as distributed and highly dynamic environments significantly expand the attack surface (ZHANG et al., 2018).

In 2023, cloud security became strongly influenced by three structural factors. First, the massive adoption of cloud-native architectures based on containers and orchestration with Kubernetes, which introduces new layers of abstraction and potential operational vulnerabilities (BURNS; BEDA; HIGHTOWER, 2019). Second, the consolidation of integrated security platforms, particularly the Cloud-Native Application Protection Platform (CNAPP) model, which brings together different categories of defense that were previously fragmented (GARTNER, 2021). Third, the rapid integration of generative artificial intelligence into corporate applications, creating new risk surfaces related to prompt manipulation, data leakage, and model exploitation.

Additionally, modern operating system observability techniques, particularly the use of extended Berkeley Packet Filter (eBPF), have become relevant instruments for monitoring and detecting malicious behavior in distributed Linux environments (HØILAND‑JØRGENSEN et al., 2018). The ability to instrument the kernel with low overhead makes it possible to observe network activity, file system activity, and system calls in real time.

In this work, we investigate how these trends converge to redefine defense strategies in cloud environments. Our objective is to integrate theoretical foundations, technical mechanisms, and contemporary operational practices in order to propose a coherent protection model for distributed infrastructures.

2. Background

Cloud security is based on the shared responsibility model between provider and customer. The provider is responsible for the security of the physical infrastructure and virtualization, while the customer retains control over configurations, applications, and identity management (AMAZON WEB SERVICES, 2023).

This model creates specific challenges, particularly when environments are composed of multiple managed services and ephemeral resources. Operational complexity increases exponentially with the adoption of microservices and automated DevOps pipelines.

2.1 Cloud Service Models

Model	Customer Responsibility	Provider Responsibility
IaaS	Operating system, applications, virtual network	Hardware, virtualization
PaaS	Applications and data	Platform, runtime, infrastructure
SaaS	Configuration and identity	Application, infrastructure, and runtime

The distinction between these models directly influences the applicable security control mechanisms (MELL; GRANCE, 2011).

2.2 Cloud-Native Architectures

Modern architectures are characterized by containers, microservices, and automated orchestration. Kubernetes has become the de facto standard for managing distributed clusters. Although it provides isolation and scalability, configuration errors such as excessive permissions in RBAC or improper exposure of APIs constitute frequent attack vectors (BURNS; BEDA; HIGHTOWER, 2019).

3. Contemporary Threats in Cloud Environments

Recent studies show that cloud incidents often result from configuration failures and identity management weaknesses (IBM, 2023). Among the most relevant vectors observed up to 2023 are:

• Storage bucket exposure
• Compromise of API keys
• Software supply chain attacks
• Exploitation of management APIs
• Privilege escalation in Kubernetes environments

3.1 Risks Associated with Generative Artificial Intelligence

The incorporation of large language models into enterprise applications introduces new security risks. Among the main ones are prompt injection attacks, in which malicious instructions manipulate model behavior to bypass security policies or reveal sensitive information (GOULD et al., 2023).

In addition, data sent to external models may result in the exfiltration of confidential information, especially when logs or conversation histories are stored by providers.

4. Cloud-Native Application Protection Platform (CNAPP)

The CNAPP concept emerged as an attempt to consolidate different categories of cloud security tools. Traditionally, organizations used separate solutions for configuration monitoring, workload protection, and vulnerability analysis.

CNAPP integrates components such as:

Component	Function
CSPM	Infrastructure configuration assessment
CWPP	Protection of running workloads
CIEM	Permission and identity management
Container Security	Image and runtime analysis

This convergence reduces visibility gaps and enables the correlation of security events across multiple layers of the infrastructure (GARTNER, 2021).

5. Security Observability with eBPF

eBPF is a Linux kernel technology that allows verified programs to run safely within kernel space. This capability makes deep system instrumentation possible without requiring modifications to kernel code (HØILAND‑JØRGENSEN et al., 2018).

Modern tools use eBPF to monitor system calls, network flows, and process events in containers.

Simplified example of tracing process executions with eBPF:

bpftrace -e 'tracepoint:syscalls:sys_enter_execve
{
  printf("Processo executado: %s\n", str(args->filename));
}'

This type of observability makes it possible to detect anomalous activity in real time, such as unexpected shell execution inside compromised containers.

6. Formal Risk Assessment Model in Multi-Cloud Environments

We propose a quantitative risk assessment model for multi-cloud environments based on three main variables: exposure ($E$), asset criticality ($C$), and exploitation probability ($P$).

The total risk of an asset $i$ can be defined as:

$$ R_i = E_i \times C_i \times P_i $$

Where:

• $E_i$ represents the external exposure level of the resource
• $C_i$ represents the potential impact of compromise
• $P_i$ represents the probability of exploitation based on known vulnerabilities

For an environment with $n$ assets, the aggregate risk is:

$$ R_{total} = \sum_{i=1}^{n} R_i $$

This model makes it possible to prioritize security remediation based on quantitative impact.

6.1 Integration with Security Telemetry

Telemetry data from CNAPP platforms and eBPF sensors can automatically feed the model parameters. For example:

Data Source	Derived Metric
IAM logs	Probability of credential abuse
Vulnerability scanner	Exploitation probability
eBPF telemetry	Behavioral indicators

This integration enables continuous risk assessment in dynamic environments.

7. AI Governance in Cloud Infrastructures

With the growing adoption of machine learning-based systems, AI governance has become an essential component of organizational security. Governance structures include data retention policies, prompt validation, and auditing of interactions with models.

AI risk management frameworks, such as the NIST AI Risk Management Framework, provide guidelines for mitigating risks associated with the use of AI in critical systems (NIST, 2023).

8. Discussion

The convergence of deep observability, policy automation, and integrated platforms represents a significant evolution in cloud environment defense. However, challenges persist, particularly in correlating distributed events and managing identities in highly dynamic environments.

Furthermore, the integration of AI-based systems expands the scope of traditional security. Organizations must consider not only technical vulnerabilities, but also semantic manipulation and language-based attacks.

9. Conclusion

Cloud computing security in 2023 requires a multidimensional approach that combines cryptographic mechanisms, real-time monitoring, and artificial intelligence governance. CNAPP platforms offer operational integration across different defense layers, while technologies such as eBPF significantly expand visibility into system behavior.

The proposed formal risk model demonstrates that quantitative metrics can guide mitigation decisions in complex and distributed environments. As digital infrastructures become increasingly dependent on automation and AI, security strategies must evolve to incorporate behavioral monitoring, formal verification, and adaptive policies.

References

AMAZON WEB SERVICES. AWS Shared Responsibility Model. 2023. Available at: https://aws.amazon.com/compliance/shared-responsibility-model/. Accessed on: 10 Mar. 2023.

BURNS, Brendan; BEDA, Joe; HIGHTOWER, Kelsey. Kubernetes: Up and Running. 2. ed. Sebastopol: O’Reilly Media, 2019. Available at: https://www.oreilly.com/library/view/kubernetes-up-and/9781492046523/

BEHL, Abhishek; BEHL, Kriti. Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford: Oxford University Press, 2017. Available at: https://global.oup.com/academic/product/cybersecurity-and-cyberwar-9780199918096

BHATIA, Saurabh et al. Cloud Security: Concepts, Methodologies, Tools, and Applications. Hershey: IGI Global, 2020. Available at: https://www.igi-global.com/book/cloud-security-concepts-methodologies-tools/242381

BROWN, Gavin et al. Detecting Kubernetes Security Misconfigurations. IEEE Security & Privacy, 2021. Available at: https://ieeexplore.ieee.org/document/9447197

ENISA. Cloud Security for SMEs. European Union Agency for Cybersecurity, 2022. Available at: https://www.enisa.europa.eu/publications/cloud-security-for-smes

GARTNER. Innovation Insight for Cloud-Native Application Protection Platforms. 2021. Available at: https://www.gartner.com/en/documents/4007016

GOULD, R.; HODGES, J.; RYAN, M. Prompt Injection Attacks Against Large Language Models. 2023. Available at: https://arxiv.org/abs/2302.12173

HØILAND‑JØRGENSEN, Toke et al. The eBPF Ecosystem. Proceedings of the Linux Plumbers Conference, 2018. Available at: https://ebpf.io

IBM. Cost of a Data Breach Report 2023. Armonk: IBM Security, 2023. Available at: https://www.ibm.com/reports/data-breach

KREBS, Brian. Spam Nation: The Inside Story of Organized Cybercrime. Naperville: Sourcebooks, 2014. Available at: https://krebsonsecurity.com/book

MELL, Peter; GRANCE, Timothy. The NIST Definition of Cloud Computing. NIST Special Publication 800‑145. 2011. Available at: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

NIST. AI Risk Management Framework (AI RMF 1.0). 2023. Available at: https://www.nist.gov/itl/ai-risk-management-framework

OWASP. Top 10 Cloud Security Risks. 2022. Available at: https://owasp.org/www-project-cloud-top-10

SHOSTACK, Adam. Threat Modeling: Designing for Security. Indianapolis: Wiley, 2014. Available at: https://www.wiley.com/en-us/Threat+Modeling-p-9781118809990

SOMOROVSKY, Juraj. Systematic Fuzzing and Testing of TLS Libraries. IEEE Symposium on Security and Privacy, 2016. Available at: https://ieeexplore.ieee.org/document/7546510

STALLINGS, William. Network Security Essentials. 6. ed. Boston: Pearson, 2017. Available at: https://www.pearson.com

TALOS, Cisco. Kubernetes Threat Landscape. 2022. Available at: https://blog.talosintelligence.com

ZHANG, Qi; CHEN, Min; LI, Laurence. Cloud Computing: State-of-the-Art and Research Challenges. Journal of Internet Services and Applications, 2018. Available at: https://link.springer.com/article/10.1186/s13174-018-0087-1

ZHOU, Z.; LI, Y.; CHEN, X. Security and Privacy in Cloud Computing: A Survey. IEEE Access, 2020. Available at: https://ieeexplore.ieee.org/document/9099066

KIM, Gene et al. The DevOps Handbook. Portland: IT Revolution Press, 2016. Available at: https://itrevolution.com

SCARFONE, Karen; SOUPPAYA, Murugiah. Guide to Security for Full Virtualization Technologies. NIST, 2011. Available at: https://nvlpubs.nist.gov

BEHRENDT, Michael et al. Cloud Native Security Patterns. 2022. Available at: https://www.cncf.io/reports

CNCF. Cloud Native Security Whitepaper. 2022. Available at: https://www.cncf.io/reports/cloud-native-security-whitepaper

MICROSOFT. Azure Security Benchmark v3.0. 2022. Available at: https://learn.microsoft.com/security/benchmark/azure

GOOGLE CLOUD. Security Foundations Guide. 2023. Available at: https://cloud.google.com/security-foundations

RUSSELL, Stuart; NORVIG, Peter. Artificial Intelligence: A Modern Approach. 4. ed. Hoboken: Pearson, 2021. Available at: https://aima.cs.berkeley.edu