What are two of the four Cs of cloud-native security?

Two of the four Cs of cloud-native security are Code and Clusters. The four-Cs model is commonly used to organize cloud-native security responsibilities across layers: cloud, cluster, container, and code. Code is the application logic and dependencies that developers produce, and it must be secured through review, scanning, dependency management, and secrets control. Cluster refers to the orchestration environment that runs workloads, commonly Kubernetes, and must be secured through access control, configuration hardening, network policy, and runtime monitoring. Configurations are extremely important in cloud security, but “Configurations” is not one of the four Cs in this model. Connections are also important, especially for service communication and network policy, but they are not one of the named four Cs. The model is useful because cloud-native risk is layered: weak code, vulnerable containers, misconfigured clusters, or insecure cloud infrastructure can each become an attack path. Reference/topics: Cloud Security 5.5, CNSP; Cloud Security 5.4, container, microservice, and cloud terms.