← Back
Home › Systems › Security and identity

cnapp

cloud security posture + workload protection

Wiz, Prisma Cloud, Orca

SystemTechniques · 20Primitives · 76 cnapp Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Durable job queuedistributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Policy engines (PDP/PEP, Cedar, Reg…security · medium: Decide allow/deny for (principal, action, resource, context) in a separate engine with default deny, forbid-wins and an auditable list of determining policies.›Vulnerability advisory matchingsecurity · medium: Matching package versions against advisory databases (OSV, NVD, distro feeds) with ecosystem-specific rulesWorkload identity (SPIFFE-style)security · medium: A local agent works out which workload is calling, then hands it a short-lived signed identity that it renews automatically; no secret is shipped in advance.›Exponential backoff with jittersystems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Semver range matchingcompilers · low: Semantic version parsing, ordering and range matchingSoftware bill of materialssecurity · low: SBOM generation (SPDX/CycloneDX) and component matchingMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Copy on write snapshotsstorage · low: Point-in-time snapshots by sharing pages/extents and copying only on writeEbpfhardware-os · low: Verified in-kernel programs on hooks (kprobes, XDP, tc) with mapsHdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesBFS and DFSgraphs · low: The two basic graph traversals; BFS gives hop distances and levels, DFS gives discovery/finish order for cycles, components and topological order.›Process supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Cursor paginationnetworking · low: Keyset/opaque-cursor pagination for stable incremental reads from APIs and tablesLongest prefix matchnetworking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IPCryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›Least privilege and isolationsecurity · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.›Os event tracingsecurity · low: OS telemetry sources for security agents: ETW, Endpoint Security, fanotify, audit, kernel callbacksSecret scanningsecurity · low: Detect committed credentials with provider-specific patterns, entropy checks and live verification, then revoke+ 13 more techniques+ 60 more primitives

Similar systems

Share the most building blocks with this one.

vuln-scanner 34 %compliance-automation 33 %model-supply-chain 32 %mcp-supply-chain 30 %ci-server 29 %

In-house systems

Named systems of this kind at large companies, with their paper or write-up.

Cloud CustodianCapital One Financial