Cloud Security Engineer

Cloud Security consists of a set of policies, controls, procedures, and technologies that work together to protect cloud-based systems, data, and infrastructure. It is critical because as businesses move sensitive data to the cloud, they face unique risks like data breaches, unauthorized access, and misconfigurations that can lead to massive exposure.

The Shared Responsibility Model dictates that security is a partnership between the Cloud Provider (CSP) and the Customer. The CSP (e.g., AWS) is responsible for 'Security OF the Cloud' (physical hardware, regions, global infrastructure). The Customer is responsible for 'Security IN the Cloud' (data, IAM, network configuration, and encryption).

1. IaaS: Customer manages OS, Apps, and Data. 2. PaaS: Customer manages only Apps and Data; CSP manages the underlying OS. 3. SaaS: CSP manages everything; Customer is only responsible for identity and how they configure the software settings.

Key challenges include: 1. Lack of visibility into cloud assets. 2. Complex Identity and Access Management (IAM). 3. Misconfigurations (e.g., public S3 buckets). 4. Insecure APIs. 5. Data residency/compliance issues in different regions.

The CIA Triad stands for: 1. Confidentiality (ensuring data is accessible only to authorized users via encryption). 2. Integrity (ensuring data isn't altered during transit or at rest). 3. Availability (ensuring systems are up and reachable via DDoS protection and high availability).

Defense in Depth is a security strategy that implements multiple layers of security controls throughout an IT system. If one layer (e.g., a firewall) fails, others (e.g., MFA, encryption, endpoint protection) are in place to block the attacker.

PoLP is the practice of limiting user or system access rights to only what is strictly necessary to perform a job function. In the cloud, this means granting the minimum required IAM permissions and using conditions to restrict access further.

Zero Trust is a security framework based on the principle of 'Never Trust, Always Verify.' It assumes that threats exist both inside and outside the network. Every access request must be authenticated, authorized, and continuously validated regardless of its origin.

On-premise security relies on physical perimeters (fences, locked server rooms) and hardware firewalls. Cloud security is software-defined and relies heavily on Identity (IAM) as the new perimeter, APIs for management, and automated logging.

The OWASP Cloud Top 10 lists the most critical security risks to cloud environments, including: Accountability and Data Ownership, Improper Key Management, Insecure SDKs, and Insufficient Identity/Access controls.

CSPM tools (like AWS Config or Azure Policy) continuously monitor cloud environments for misconfigurations and compliance violations. They provide automated remediation to ensure the environment stays within a secure baseline.

CWPP focuses on protecting the actual 'workloads' (VMs, Containers, Serverless functions). It provides agent-based or agentless protection against malware, vulnerabilities, and runtime threats within the compute instance.

A CASB is a security checkpoint between cloud service users and cloud applications. It enforces security policies such as data loss prevention (DLP), encryption, and access control for SaaS applications.

CSPM looks at the control plane (Are my S3 buckets public? Is MFA enabled?). CWPP looks inside the data plane (Is there malware on this EC2? Is this container image vulnerable?).

A strategy for securing environments that span multiple vendors (e.g., AWS and Azure). It involves using vendor-neutral tools (like HashiCorp Vault or Terraform) and standardized identity providers (IdP) to maintain consistent security policies.

Securing an environment that mixes on-premise data centers with public cloud services. The main challenge is securing the connection (VPN/Direct Connect) and maintaining a unified identity system (Active Directory syncing to the cloud).

Shadow IT is the use of cloud services (like Dropbox or personal AWS accounts) by employees without the knowledge or approval of the IT department. It is detected via CASBs, firewall log analysis, and network traffic monitoring.

The process of ensuring that cloud services meet regulatory and industry standards. This involves regular audits, documentation of controls, and continuous monitoring of technical configurations.

1. SOC 2: Focuses on security, availability, and privacy. 2. ISO 27001: Global standard for ISMS. 3. PCI-DSS: Standard for companies handling credit card data.

GDPR is an EU regulation on data protection and privacy. It requires cloud users to ensure data encryption, provide 'right to be forgotten,' and strictly control where data is physically stored (data residency).

HIPAA protects healthcare data (PHI). For cloud security, this means signing a Business Associate Agreement (BAA) with the CSP and ensuring all PHI is encrypted at rest and in transit.

Residency refers to the physical location where data is stored. Sovereignty means the data is subject to the laws of the country where it is located. Cloud engineers must use 'Region' restrictions to comply.

An assessment of a cloud environment's security controls. It involves reviewing IAM policies, network logs, encryption settings, and incident response plans against a specific framework.

Authorized simulated attacks on cloud resources. Unlike on-premise, you usually do not test the CSP's underlying infrastructure; you test your own apps, APIs, and misconfigured permissions.

The continuous cycle of identifying, classifying, prioritizing, and remediating software vulnerabilities. In the cloud, this includes scanning OS patches, container images, and IaC templates.

The process of reacting to a security breach. It involves detection (CloudTrail/GuardDuty), containment (isolating compromised EC2s), eradication, and recovery.

Strategies to restore systems after a major failure. It leverages the cloud's ability to quickly spin up infrastructure in different geographical regions (Pilot Light, Warm Standby, or Multi-site).

A high-level plan ensuring the organization can continue operating during a cloud outage. It includes DR but also covers workforce communication and manual workarounds.

The process of creating copies of data in separate locations. A secure strategy includes encrypting backups with separate keys and using 'Object Lock' to prevent deletion by ransomware.

An operational model where servers are never patched or modified once deployed. If a change or patch is needed, a new server is built from a common image and the old one is destroyed. This prevents 'configuration drift' and improves security auditability.

AWS IAM is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources in your AWS account.

1. User: An entity representing a person or service (permanent credentials). 2. Group: A collection of IAM users. Permissions assigned to a group are inherited by its users. 3. Role: An identity with specific permissions that can be 'assumed' by anyone who needs it (temporary credentials).

A User has permanent credentials (password/access keys) and is uniquely associated with one person. A Role does not have permanent credentials; instead, it provides temporary security tokens and is intended to be assumed by users, applications, or AWS services.

An IAM policy is a JSON document that defines permissions. Its structure includes: Version, Statement ID (Sid), Effect (Allow/Deny), Principal (who), Action (what), Resource (which), and Condition (when).

1. Managed Policies: Standalone policies you can attach to multiple users/groups/roles. 2. Inline Policies: Policies embedded directly into a single user, group, or role; they have a 1:1 relationship with the identity.

AWS Managed are created and administered by AWS (e.g., AdministratorAccess). Customer Managed are standalone policies you create in your account, offering finer control and versioning tailored to your specific needs.

AWS evaluates policies by: 1. Defaulting to a Deny. 2. Evaluating all applicable policies. 3. Looking for an Explicit Deny (which always wins). 4. Looking for an Allow. If no Allow is found, the final decision is an Implicit Deny.

An Implicit Deny occurs by default if there is no 'Allow' statement. An Explicit Deny is a statement in a policy that specifically uses `"Effect": "Deny"`. An explicit deny overrides any allow, regardless of where it is defined.

A permissions boundary is an advanced feature where you use a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. It acts as a 'ceiling' for permissions.

SCPs are organization policies used to manage permissions in your organization. They offer central control over the maximum available permissions for all accounts in your organization, ensuring accounts stay within access control guidelines.

IAM Policies grant permissions to specific users or roles within an account. SCPs restrict permissions for the entire account (including the Root user), but they do not grant permissions by themselves.

It allows a user in one AWS account to access resources in another account. This is typically achieved by creating a role in the target account that trusts the source account, allowing the user to 'Assume' that role.

AssumeRole is an API call in AWS STS that returns a set of temporary security credentials. It is used for cross-account access, granting permissions to AWS services (like EC2), or federated identity access.

A tool that helps identify the resources in your account (like S3 buckets or IAM roles) that are shared with an external entity. It uses logic-based reasoning to analyze resource-based policies.

STS is a web service that enables you to request temporary, limited-privilege credentials for IAM users or for users you authenticate (federated users).

Credentials provided by STS that consist of an Access Key ID, a Secret Access Key, and a Security Token. They are short-lived (minutes to hours) and automatically expire, reducing the risk of compromised long-term keys.

MFA adds an extra layer of protection on top of a username and password. Users must provide a code from a virtual device (App), a hardware TOTP token, or a FIDO security key to gain access.

A report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices. It is used for auditing and compliance.

A service that helps you protect secrets needed to access your applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets.

A capability of AWS Systems Manager that provides secure, hierarchical storage for configuration data management and secrets management (SecureString).

Secrets Manager supports automatic secret rotation, generates random secrets, and costs money per secret. Parameter Store (Standard) is free, does not support native rotation, and is better for general configuration data.

A managed service that makes it easy for you to create and control the cryptographic keys used to encrypt your data. It is integrated with most AWS services.

Now simply called AWS KMS keys, it is the primary resource in KMS. It contains the key material used to encrypt and decrypt data and can never leave the KMS service unencrypted.

AWS Managed Keys are created automatically by AWS services and are free. Customer Managed Keys are created by you, offer full control over rotation and policies, and incur a monthly cost.

The practice of encrypting plaintext data with a Data Key, and then encrypting that Data Key under a KMS Key. This allows for efficient encryption of large data without sending the data itself to KMS.

The process of generating new cryptographic material for a KMS key. AWS managed keys rotate every year; Customer managed keys can be set to rotate automatically every year or rotated manually.

A cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. It provides FIPS 140-2 Level 3 compliance.

KMS is a multi-tenant managed service (FIPS 140-2 Level 2). CloudHSM is a single-tenant, dedicated hardware device that you fully control (FIPS 140-2 Level 3), used for strict regulatory requirements.

A service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like CloudFront and ALBs.

A cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation.

A threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads by analyzing CloudTrail, VPC Flow Logs, and DNS logs.

A fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3 (e.g., PII).

An automated vulnerability management service that continually scans AWS workloads (EC2, ECR images, Lambda functions) for software vulnerabilities and unintended network exposure.

GuardDuty is an Intrusion Detection System (IDS) that looks for *active* threats in logs. Inspector is a vulnerability scanner that looks for *potential* weaknesses in software and configuration.

A service that makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities by aggregating data from your AWS resources.

A service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It records configuration changes and compares them against desired 'Rules'.

Custom or managed rules that define the 'ideal' configuration for a resource. For example, a rule to ensure all S3 buckets have encryption enabled. If a resource violates the rule, Config marks it as non-compliant.

A service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records every API call made in the account (who, what, when, where).

Event History shows the last 90 days of management events for free. A Trail is a configuration that delivers these events to an S3 bucket for long-term storage and can include Data Events (S3 object-level actions).

A feature that helps AWS users identify unusual operational activity in their AWS accounts by analyzing CloudTrail management events for spikes in API calls or error rates.

A VPC is a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. It gives you complete control over your networking environment.

A Public Subnet has a route to the internet via an Internet Gateway. A Private Subnet does not have a direct route to the internet; instances there usually use a NAT Gateway for outbound traffic.

Internet Gateway allows bi-directional traffic between a public subnet and the internet. NAT Gateway allows instances in a private subnet to connect to the internet (outbound) but prevents the internet from initiating a connection to them (inbound).

A virtual firewall for your EC2 instances to control incoming and outgoing traffic. It is Stateful (if you allow inbound, outbound is automatically allowed) and operates at the instance level.

An optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. It is Stateless and uses numbered rules evaluated in order.

1. Scope: SG is at instance level; NACL is at subnet level. 2. State: SG is stateful; NACL is stateless. 3. Rules: SG allows rules only; NACL supports allow and deny rules.

A feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. It is vital for network auditing and troubleshooting connection issues.

A networking connection between two VPCs that enables you to route traffic between them using private IPv4 or IPv6 addresses. Both VPCs behave as if they were on the same network.

A network transit hub that you can use to connect your VPCs and your on-premises networks. It simplifies network topology by eliminating complex peering relationships.

A technology that provides high-availability connectivity between VPCs or AWS services without exposing data to the public internet. It keeps traffic within the AWS network.

Allows you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway or NAT device.

Gateway Endpoints are free and used only for S3 and DynamoDB (configured via route tables). Interface Endpoints cost money, use an ENI with a private IP, and are powered by PrivateLink for most other services.

A firewall that helps protect your web applications or APIs against common web exploits like SQL injection and Cross-Site Scripting (XSS). It operates at Layer 7 (Application).

Standard is free and protects all AWS customers from common Layer 3/4 DDoS attacks. Advanced provides higher-level protection for ALBs and CloudFront, 24/7 access to the DDoS response team, and cost protection.

DDoS (Distributed Denial of Service) attempts to overwhelm a target with a flood of internet traffic. Shield protects by using anomaly detection, deterministic packet filtering, and traffic scrubbing.

A security management service which allows you to centrally configure and manage firewall rules (WAF, Shield Advanced, Security Groups) across your accounts and applications in AWS Organizations.

A managed service that makes it easy to deploy essential network protections for all of your Amazon VPCs. It provides an intrusion prevention system (IPS), firewall, and web filtering (Layer 3-7).

The combination of multiple controls to protect data in S3: Block Public Access, IAM policies, Bucket policies, Encryption (KMS), Versioning, and Logging.

S3 supports server-side encryption (SSE) to protect data at rest. Options include SSE-S3 (AWS-managed keys), SSE-KMS (AWS KMS keys), and SSE-C (customer-provided keys). Client-side encryption is also supported.

Bucket Policy is resource-based (attached to the bucket) and defines who can access the bucket from any account. IAM Policy is identity-based (attached to a user/role) and defines what that user can do.

Access Control Lists are a legacy way to manage access to buckets and objects. AWS now recommends using Bucket Policies instead for simpler and more robust management.

A bucket-level or account-level setting that provides a master lock to prevent any S3 resource from ever being made public, overriding any existing policies or ACLs.

1. SSE-S3: AWS manages keys. 2. SSE-KMS: You manage keys in KMS (Audit trail). 3. SSE-C: You provide and manage the keys; AWS only performs the encryption.

A means of keeping multiple variants of an object in the same bucket. It protects against accidental deletions or overwrites, allowing you to recover original data.

A configuration that requires multi-factor authentication to permanently delete an object version or change the versioning state of the bucket.

Prevents an object from being deleted or overwritten for a fixed amount of time or indefinitely. It is used for 'WORM' (Write Once Read Many) compliance.

Named network endpoints with dedicated access policies that describe how data can be accessed using that endpoint. It simplifies managing data access at scale for shared datasets.

Server access logging provides detailed records for the requests that are made to a bucket. This is useful for security and access audits.

Protected by AWS Shield, AWS WAF, and SSL/TLS. You can also restrict access to S3 origins using Origin Access Control (OAC) and secure content via Signed URLs.

A legacy feature (replaced by OAC) that allows CloudFront to access your S3 bucket while preventing users from accessing the bucket directly via S3 URLs.

1. Apply Least Privilege to the execution role. 2. Use VPC integration to access private resources. 3. Store secrets in Secrets Manager, not environment variables. 4. Use Code Signing to ensure only trusted code is deployed. 5. Set memory and timeout limits to prevent resource exhaustion attacks.

An IAM role that the Lambda function assumes when it is invoked. It grants the function permissions to access other AWS services, such as reading from an S3 bucket or writing logs to CloudWatch.

A policy attached to the Lambda function itself (not the role) that defines which services or accounts have permission to invoke the function (e.g., allowing an S3 bucket to trigger the Lambda).

By default, environment variables are encrypted at rest using a default AWS KMS key. For sensitive data, you can use a Customer Managed Key (CMK) and encrypt the values on the client-side before deployment.

It involves: 1. Image Security (scanning ECR). 2. Identity (using IAM Roles for Tasks/Service Accounts). 3. Network Isolation (Security Groups/Network Policies). 4. Runtime Security (monitoring container behavior).

A feature in Amazon Elastic Container Registry that uses the open-source Clair project or Amazon Inspector to scan container images for software vulnerabilities (CVEs) during push or on-demand.

Role-Based Access Control used to manage permissions within the Kubernetes cluster. In EKS, it is often integrated with AWS IAM via the `aws-auth` ConfigMap or the EKS Access Entry API.

A legacy Kubernetes resource (now replaced by Pod Security Admission) that controls security-sensitive aspects of pod specification, such as preventing pods from running as 'root' or using the host network.

RDS security is multi-layered: 1. Network: Use VPC and Security Groups. 2. Access: IAM DB Authentication or Master Password. 3. Encryption: KMS at rest and SSL/TLS in transit.

Encrypts the underlying storage of the DB instance, its automated backups, read replicas, and snapshots using an AWS KMS key.

Ensures that the connection between the application and the RDS instance is secured using SSL/TLS. You can enforce this by setting the `rds.force_ssl` parameter to 1 in the DB Parameter Group.

Allows you to authenticate to your DB instance using IAM users or roles instead of a traditional password. It uses temporary security tokens and is more secure for application-to-database access.

If the RDS instance is encrypted, the automated backups and snapshots are automatically encrypted using the same KMS key.

DynamoDB data is always encrypted at rest. By default, it uses an AWS owned key, but you can choose to use an AWS managed key or a Customer Managed Key (CMK) in KMS.

Using IAM policy conditions (like `dynamodb:LeadingKeys`) to restrict users to only access specific items in a table based on their User ID or other attributes.

A service that provides authentication, authorization, and user management for web and mobile apps. Users can sign in directly with a user name and password, or through a third party like Facebook, Amazon, or Google.

User Pools are user directories that provide sign-in and sign-up options (Authentication). Identity Pools enable you to grant your users access to other AWS services (Authorization) by providing temporary AWS credentials.

Now called AWS IAM Identity Center, it allows you to centrally manage SSO access to all your AWS accounts and cloud applications. It supports integration with Active Directory, Okta, and Google Workspace.

Enables your directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud. It allows for seamless integration of on-premise AD with AWS.

A service that allows you to securely share your AWS resources (like Subnets, Transit Gateways, or License Configurations) with any AWS account or within your AWS Organization.

Provides the easiest way to set up and govern a secure, multi-account AWS environment (Landing Zone). It automates the setup of accounts and applies 'Guardrails' (SCPs and Config Rules) to ensure compliance.

A well-architected, multi-account AWS environment that is a starting point from which you can deploy complex workloads. It includes baseline security, logging, and networking configurations.

A set of design principles and best practices for securing cloud workloads. Key areas include: Identity and Access Management, Detection, Infrastructure Protection, Data Protection, and Incident Response.

An online tool that provides real-time guidance to help you provision your resources following AWS best practices. Security checks include: open security groups, public S3 buckets, and MFA on the root account.

A service that helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. It automates evidence collection.

A central resource for compliance-related information that provides on-demand access to AWS’s security and compliance reports (SOC, PCI) and online agreements (BAA).

A feature that allows you to copy network traffic from an elastic network interface (ENI) and send it to security and performance monitoring appliances for deep packet inspection.

A fully managed service that lets you manage your EC2 instances through an interactive one-click browser-based shell or via the AWS CLI without the need to open SSH/RDP ports (22/3389) or use bastion hosts.

Bastion Host is an EC2 instance that acts as a gateway; it requires port 22 to be open and SSH key management. Session Manager is more secure as it requires no open ports, logs all commands to S3/CloudWatch, and uses IAM for access control.

An updated version of the EC2 instance metadata service that adds session-oriented authentication (requiring a token). It protects against SSRF (Server-Side Request Forgery) vulnerabilities that could leak IAM role credentials.

Now called Microsoft Entra ID, it is a cloud-based identity and access management service. It helps employees sign in and access external resources (O365, SaaS apps) and internal resources on your corporate network.

On-premise AD uses Kerberos/NTLM and manages servers/computers in a physical network. Azure AD (Entra ID) is a cloud identity service using modern protocols (SAML, OIDC, OAuth) and is designed for web-based applications and mobile devices.

A dedicated and isolated instance of the Microsoft Entra ID service, created when an organization signs up for a Microsoft cloud service subscription. It represents the organization's directory.

1. User: A person identity. 2. Service Principal: An identity for an application to access specific resources. 3. Managed Identity: An automated service principal managed by Azure for Azure resources (no credentials needed).

A system that provides fine-grained access management of Azure resources. You use it to segregate duties within your team and grant only the amount of access that users need to perform their jobs.

Azure RBAC manages access to Azure Resources (VMs, Storage). Azure AD Roles manage access to AD Objects (Users, Groups, Domains) and administrative tasks within the directory.

If the built-in Azure roles don't meet the specific needs of your organization, you can create your own custom roles with specific permissions (Actions/NotActions) defined in a JSON file.

The 'if-then' engine of Entra ID. It allows you to enforce controls based on signals like User Location, Device Health, or Application (e.g., 'If a user is off-network, then require MFA').

A tool that allows organizations to automate the detection and remediation of identity-based risks, like leaked credentials or logins from anonymous IP addresses (Tor).

A service that enables you to manage, control, and monitor access to important resources. It features Just-In-Time (JIT) access to reduce the time that users have elevated permissions.

A security practice where users are granted elevated permissions only when needed and for a limited duration. In PIM, users 'activate' a role, which might require approval or MFA.

Microsoft’s two-step verification solution. It uses the Microsoft Authenticator app, phone calls, or SMS codes to verify identity.

B2B (Business-to-Business): Allows you to share your apps with guest users from other organizations. B2C (Business-to-Consumer): A customer identity management solution for your own consumer-facing applications.

A cloud service for securely storing and accessing secrets, such as API keys, passwords, certificates, or cryptographic keys.

1. Secrets: Sensitive strings (passwords). 2. Keys: Cryptographic keys (for disk encryption). 3. Certificates: Managed X.509 certificates.

Access Policies (legacy) are vault-level permissions. Azure RBAC for Key Vault (recommended) provides fine-grained control at the individual secret/key level using Azure's standard identity management.

Provides an identity for applications to use when connecting to resources that support Azure AD authentication. It eliminates the need for developers to manage credentials in code.

System-assigned is tied to a single Azure resource (deleted when the resource is). User-assigned is a standalone resource that can be assigned to multiple Azure resources.

Layers include: 1. Authentication (Shared Keys or Azure AD). 2. Authorization (SAS or RBAC). 3. Encryption (SSE at rest, HTTPS in transit). 4. Network (Firewalls and Private Endpoints).

Two 512-bit strings used to authenticate access to your storage account. They grant full administrative access. They should be protected and rotated frequently using Key Vault.

A SAS is a URI that grants restricted access rights to Azure Storage resources. It allows you to specify what resources a client can access, what permissions they have (read, write, delete), and how long the URI is valid.

1. Service SAS: Grants access to a specific resource (e.g., a single blob). 2. Account SAS: Grants access to one or more storage services (Blob, File, Queue). 3. User Delegation SAS: Secured with Azure AD credentials, offering better auditability and security.

Azure Storage encryption for data at rest (SSE) is enabled for all storage accounts and cannot be disabled. It uses 256-bit AES encryption. By default, Microsoft manages the keys, but you can use your own.

CMK allows users to have full control over the keys used to encrypt data at rest. You store these keys in Azure Key Vault and manage their rotation, access policies, and auditing.

A security layer that limits access to your storage account to specific IP addresses, IP ranges, or specific virtual networks (VNets).

A network interface that uses a private IP address from your VNet. This brings the service (like Storage or SQL) into your virtual network, effectively making it accessible only via the private network.

The fundamental building block for your private network in Azure. It enables Azure resources (like VMs) to securely communicate with each other, the internet, and on-premises networks.

A virtual firewall that contains security rules to allow or deny inbound and outbound network traffic to several types of Azure resources. It operates at the NIC or Subnet level.

ASGs allow you to group VMs together based on their function (e.g., 'WebServers') and define network security policies based on those groups, rather than individual IP addresses.

A managed, cloud-based network security service that protects your Azure VNet resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.

Provides centralized protection of your web applications from common exploits and vulnerabilities (like SQL injection). It can be deployed with Azure Application Gateway or Azure Front Door.

Automatically mitigates DDoS attacks to ensure application availability. It offers two tiers: Basic (free, infrastructure level) and Network Protection (tuned specifically for your VNet resources).

A fully managed PaaS service that provides secure and seamless RDP and SSH access to your VMs directly through the Azure portal over SSL. It eliminates the need for public IP addresses on VMs.

A specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet.

A private connection that lets you extend your on-premises networks into the Microsoft cloud over a dedicated line provided by a connectivity provider. It does not go over the public internet.

Connects two Azure virtual networks. Once peered, the virtual networks appear as one for connectivity purposes. Traffic between virtual machines in peered networks uses the Microsoft backbone infrastructure.

Service Endpoints provide secure and direct connectivity to Azure services over the Azure backbone, but the service still has a public IP. Private Endpoints use a private IP from your VNet, removing the public IP entirely.

A unified infrastructure security management system that strengthens the security posture of your data centers and provides advanced threat protection across your hybrid workloads in the cloud.

The rebranded Azure Security Center. It provides CSPM (Posture Management) and CWPP (Workload Protection) for Azure, on-premise, and even other clouds like AWS.

Provides visibility into your compliance with industry standards and best practices. It gives you a Secure Score and actionable recommendations to fix misconfigurations.

Advanced threat protection for your workloads (VMs, SQL, Containers, Key Vault). It detects unusual and potentially harmful attempts to access or exploit your resources.

A measurement of an organization's security posture. The higher the percentage, the lower the identified risk level. It is improved by completing the recommended security actions.

A scalable, cloud-native, SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution.

SIEM collects and analyzes log data to detect threats. SOAR automates the response to those threats (e.g., automatically blocking an IP in the firewall when an alert triggers).

Azure Monitor collects telemetry data. Log Analytics is a tool in the Azure portal used to edit and run log queries from data collected by Azure Monitor Logs.

A service you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards.

Allows cloud architects to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements (Includes Role Assignments, Policy Assignments, and Templates).

A feature in the Microsoft Purview compliance portal that helps you manage your organization’s compliance requirements with greater ease and convenience.

A cloud-based solution that helps an organization classify and protect its documents and emails by applying labels. Labels can be applied automatically based on rules, manually by users, or both.

The process of identifying and labeling sensitive data. This allows organizations to apply appropriate security controls and track how sensitive data is being used and shared.

Allows you to manage access control by defining who (identity) has what access (roles) for which resource. It provides a unified view of security policy across your entire organization.

1. User: A Google Account (person). 2. Service Account: An identity for an application. 3. Group: A collection of users/service accounts managed via Google Groups.

1. Primitive: Owner, Editor, Viewer (Broad). 2. Predefined: Granular roles managed by Google (e.g., Storage Admin). 3. Custom: User-defined roles for specific needs.

Primitive roles are high-level and grant broad access (Owner has all permissions). Predefined roles are fine-grained and adhere better to the principle of least privilege.

A collection of statements that define who has what type of access. It is attached to a resource and consists of a list of 'bindings' that associate members with roles.

Allows you to grant access only if specific conditions are met, such as the request time, resource name, or access level (e.g., 'Grant access only during business hours').

A special type of Google account intended to represent a non-human user that needs to authenticate and be authorized to access data in Google APIs and Google Cloud resources.

Keys are downloadable JSON files (Security risk). Impersonation allows a principal to temporarily act as a service account without needing a key file, which is much more secure.

The recommended way for applications running on GKE to access Google Cloud services. it maps a Kubernetes service account to a Google service account, removing the need for secrets.

An Identity as a Service (IDaaS) solution that centrally manages users and groups. It allows you to synchronize your on-premise directory (like AD) with Google Cloud.

Part of BeyondCorp, it allows you to define granular access control policies based on attributes like user identity, device security status, and IP address.

A cloud-hosted service that lets you manage cryptographic keys for your cloud services the same way you do on-premises. You can create, use, rotate, and destroy keys.

A cloud-hosted Hardware Security Module service that allows you to host encryption keys and perform cryptographic operations in FIPS 140-2 Level 3 certified modules.

A secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. It provides a single source of truth for secrets across GCP.

Google Cloud VPC provides networking functionality to Compute Engine VM instances, GKE clusters, and the App Engine flexible environment. It is global in GCP, unlike AWS/Azure.

Allows you to allow or deny traffic to and from your VM instances based on a configuration. GCP firewalls are stateful and can be applied using network tags or service accounts.

Allows you to define a security perimeter around Google Cloud resources to mitigate data exfiltration risks. It keeps data within the specified perimeter even if credentials are stolen.

Allows VM instances with only internal IP addresses to reach the public IP addresses of Google APIs and services (like Cloud Storage).

Allows Google Cloud virtual machine (VM) instances without external IP addresses to connect to the internet for outbound traffic, while blocking inbound connections.

Cloud VPN connects your peer network to your VPC via an IPsec VPN tunnel (over public internet). Cloud Interconnect provides a direct, low-latency physical connection.

Google Cloud Armor provides ML-based DDoS protection and a Web Application Firewall (WAF). it helps protect applications behind Global External HTTP(S) Load Balancers from Layer 7 attacks like SQL injection and Cross-Site Scripting (XSS).

Cloud CDN uses Google's global network to serve content. Security features include Signed URLs and Signed Cookies to restrict access to specific users and integration with Cloud Armor for edge security policies.

IAP is a building block of BeyondCorp. It controls access to applications running on GCP or on-prem by verifying user identity and the context of the request (device, location) without requiring a traditional VPN.

A deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run. It uses 'Attestations' (digital signatures) to verify that an image has passed through specific security gates (like a vulnerability scan).

A GCP service that provides vulnerability scanning and metadata storage for container images. It automatically scans images in Artifact Registry and notifies you of any new CVEs discovered in your existing images.

1. Use Workload Identity. 2. Enable Shielded Nodes. 3. Use Private Clusters. 4. Implement Network Policies for pod-to-pod communication. 5. Regularly scan images using Container Analysis.

Nodes with hardened security features that protect against rootkits and boot-level malware. It uses features like Secure Boot and Measured Boot to ensure the node's integrity hasn't been compromised.

A centralized security management and risk platform for GCP. It provides a single dashboard to view assets, find vulnerabilities (like open firewalls), and detect active threats (like cryptomining).

A built-in feature of Security Command Center that automatically scans your cloud resources for misconfigurations and maps them to compliance frameworks like CIS, PCI-DSS, or ISO 27001.

A service within SCC that analyzes Cloud Logging data in real-time to identify high-risk security threats, such as brute-force attacks, malware, or data exfiltration attempts.

A tool that identifies common web vulnerabilities in your App Engine, GKE, and Compute Engine applications, such as insecure headers or outdated libraries.

A fully managed service to discover, classify, and protect sensitive data like PII. It can automatically redact or mask sensitive info in text, images, or files stored in BigQuery, GCS, or Datastore.

A fully managed service that allows you to store, search, analyze, and alert on log data from GCP. It is essential for security auditing and post-incident investigation.

GCP logs that record 'who did what, where, and when'. Types include: Admin Activity (always on), Data Access (must be enabled), System Event, and Policy Denied logs.

A unique GCP feature that provides you with near real-time logs when Google's own support or engineering staff access your content, ensuring accountability for the provider.

IAM is the security discipline that ensures the right people and systems have access to the right resources at the right time for the right reasons. it is the fundamental 'gatekeeper' of the cloud.

Authentication (AuthN) is the process of verifying *who* you are (e.g., login). Authorization (AuthZ) is the process of verifying *what* you are allowed to do (e.g., permissions).

A session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications.

An XML-based open standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). It is commonly used for enterprise SSO.

An industry-standard protocol for Authorization. It allows an application to gain limited access to user accounts on an HTTP service, like Facebook or Google, without sharing passwords.

A simple identity layer on top of the OAuth 2.0 protocol. It allows clients to verify the identity of the end-user based on the authentication performed by an Authorization Server.

OAuth is for authorization (access tokens). OIDC is for authentication (ID tokens). OIDC tells you *who* the user is, while OAuth allows you to *do* things on their behalf.

A compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is digitally signed.

A method of linking a person's electronic identity and attributes, stored across multiple distinct identity management systems (e.g., using your corporate AD credentials to log into AWS).

A system entity that creates, maintains, and manages identity information for principals while providing authentication services to relying applications within a federation or distributed network.

A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction.

1. Something you know (Password). 2. Something you have (SMS code, TOTP App, Physical YubiKey). 3. Something you are (Biometrics).

A verification method where a user does not need to enter a password. instead, they use biometrics, a magic link sent to email, or a cryptographic key (FIDO2/WebAuthn).

Using a digital certificate (X.509) to identify a user, machine, or device before granting access. It is highly secure and commonly used for machine-to-machine communication.

Permissions are assigned to specific 'Roles' (e.g., 'Auditor'), and users are assigned to those roles. It simplifies management by grouping common permission sets.

An advanced paradigm where access rights are granted through the use of policies which combine attributes together (User attributes, Resource attributes, Environment attributes). e.g., 'Allow access if User is in Dept X and Project is Y'.

A strategy where access is managed via centralized policies that can be updated without changing the application code. It combines elements of both RBAC and ABAC.

A sub-field of IAM that focuses on the special requirements of powerful accounts (Admins, Root). It includes features like password vaulting, session recording, and just-in-time access.

The practice of periodically changing passwords, access keys, or API keys to minimize the window of opportunity if a credential is leaked.

A periodic process where managers or resource owners review and 'certify' that users still require the access they currently have. It helps identify and remove 'Privilege Creep'.

Identifying accounts that are still active but belong to employees who have left the company or changed roles. These are high-risk targets for attackers.

The process of securing non-human accounts used by applications. Best practices include rotating keys, using 'impersonation' instead of long-lived keys, and applying strict least privilege.

Securing the keys used to authenticate API requests. This includes avoiding hardcoding in scripts, using environment variables, and restricting keys by IP or service.

The tools and processes used to manage sensitive information (API keys, DB passwords, certificates) in a centralized, encrypted vault with automated rotation and audit logging.

An industry-leading open-source tool for secrets management. It provides a central place to store secrets, generate 'Dynamic Secrets' (short-lived credentials), and encrypt data as a service.

A leading enterprise solution for Privileged Access Management. It 'vaults' administrative passwords and forces admins to 'check out' credentials, recording their entire session for auditing.

A popular cloud-based Identity-as-a-Service (IDaaS) platform. It provides SSO, MFA, and automated user provisioning/deprovisioning across thousands of SaaS applications.

Azure AD (Entra ID) is deeply integrated with the Microsoft ecosystem (O365, Azure). Okta is a vendor-neutral platform known for its ease of integration with a wide variety of non-Microsoft SaaS tools.

Dividing a larger network into smaller, isolated sections (subnets) to improve performance and security. It prevents an attacker from moving easily from one part of the network to another.

An extremely granular level of segmentation that isolates workloads at the individual VM or container level. It is a key component of Zero Trust in cloud environments.

North-South is traffic entering or leaving the data center/cloud (client to server). East-West is internal traffic between servers/microservices within the cloud.

Using firewalls (NACLs/Security Groups) to ensure that resources in different subnets cannot communicate unless explicitly allowed (e.g., Web subnet can talk to App subnet, but not directly to DB subnet).

In traditional networking, a Virtual LAN. In the cloud, this concept is software-defined through VPCs and VNets, which provide logical isolation on the provider's physical hardware.

A software-defined security layer that monitors and controls incoming and outgoing network traffic based on predetermined security rules (e.g., Security Groups, Azure Firewall).

Stateful (Security Groups) remembers the state of active connections; if you allow inbound, outbound is automatically allowed. Stateless (NACLs) does not remember; you must write explicit rules for both directions.

An NGFW goes beyond traditional port/protocol filtering. It includes deep packet inspection (DPI), application-level inspection, intrusion prevention (IPS), and often SSL/TLS decryption to catch threats hidden in encrypted traffic.

An IDS is a monitoring system that detects suspicious activities or policy violations. It is 'Passive', meaning it generates alerts for security administrators but does not block traffic itself.

An IPS is 'Active'. It monitors network traffic and, when it detects a threat, it can take immediate action to block or drop the malicious packets to prevent an attack from succeeding.

The main difference is the action taken: IDS is for detection and alerting (look but don't touch), while IPS is for detection and proactive blocking (look and stop).

NIDS monitors traffic across the entire network (e.g., AWS VPC Traffic Mirroring). HIDS (like OSSEC) runs on a specific server/host and monitors system files, logs, and local processes.

Snort is an open-source NIDS capable of performing real-time traffic analysis and packet logging. It uses a rule-based language to describe what network traffic should be considered malicious.

Suricata is a high-performance, multi-threaded open-source IDS/IPS engine. It is often preferred over Snort in modern environments because it handles high bandwidth and multi-core processors more efficiently.

A WAF protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It specifically targets Layer 7 attacks like SQLi, XSS, and CSRF.

ModSecurity is a popular open-source WAF engine that acts as a module for web servers like Apache, Nginx, or IIS. It provides a robust ruleset for detecting and blocking web-based attacks.

A set of generic attack detection rules for use with ModSecurity or compatible WAFs. It provides base protection from the OWASP Top 10 with minimum false positives.

A Distributed Denial of Service attack attempts to crash a service by overwhelming it with traffic. Types include Volumetric (flooding bandwidth), Protocol (exploiting TCP handshakes), and Application Layer (heavy HTTP requests).

The most common DDoS type, where an attacker uses a botnet to saturate the target's network bandwidth with massive amounts of traffic (e.g., UDP or ICMP floods).

Targets Layer 3 and 4 infrastructure. Examples include SYN Floods, which exploit the TCP three-way handshake to consume server resources and make it unresponsive to legitimate users.

A Layer 7 attack that mimics legitimate user behavior but is designed to crash the web server (e.g., HTTP GET/POST floods or 'Low and Slow' attacks like Slowloris).

A technique to control the amount of incoming/outgoing traffic to a network or API. It prevents a single user or IP from making too many requests in a short window, mitigating DDoS and brute force.

Restricting access to a web application or resource based on the user's geographic location. It is used to block traffic from countries where the company has no business or high fraud rates.

Whitelisting allows only specific, trusted IPs to access a resource (Safe/Implicit Deny). Blacklisting blocks specific known malicious IPs but allows everyone else (Open/Implicit Allow).

CDNs provide edge security by absorbing DDoS attacks far from the origin server, providing SSL/TLS termination, and offering WAF capabilities at the network edge.

Protecting the Domain Name System from attacks like DNS Spoofing/Cache Poisoning and DDoS. It involves using managed DNS services and implementing DNSSEC.

DNS Security Extensions. It adds digital signatures to DNS records, allowing a client to verify that the DNS response it received is authentic and hasn't been tampered with.

A protocol for performing remote DNS resolution via the HTTPS protocol. It prevents eavesdropping and manipulation of DNS data by encrypting the DNS query traffic.

A method used by attackers to exfiltrate data or maintain C2 communication by hiding non-DNS traffic inside DNS queries and responses, often bypassing traditional firewalls.

A tool that creates a secure, encrypted tunnel between a user/site and a network over the public internet, ensuring data privacy and integrity.

Site-to-site connects two entire networks (e.g., On-prem DC to AWS VPC). Client VPN (or Point-to-Site) connects a single user's device to a corporate network.

A suite of protocols used to secure IP communications at the Network Layer (Layer 3). It provides authentication, integrity, and confidentiality for site-to-site tunnels.

A VPN that uses the SSL or TLS protocol to provide secure remote access. It is often easier to deploy than IPsec because it can run through a standard web browser.

A modern, high-performance VPN protocol that uses state-of-the-art cryptography. It is much simpler and faster than IPsec or OpenVPN and is gaining rapid adoption in cloud environments.

A configuration where only traffic destined for the corporate network goes through the VPN tunnel, while general internet traffic goes through the user's local ISP.

Software-Defined Wide Area Network security. It involves using software to manage WAN connections and applying centralized security policies (like encryption and firewalls) across all branch locations.

The process of intercepting and examining network traffic to identify security threats, performance issues, or policy violations using behavioral analysis and machine learning.

The process of intercepting and logging raw data packets as they cross a network. It is used for deep forensic investigation to understand exactly what happened during an attack.

The world's most popular open-source network protocol analyzer. It allows security engineers to see what's happening on their network at a microscopic level.

A powerful command-line packet analyzer. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

NetFlow (Cisco) tracks IP 'flows' (summarized traffic metadata). sFlow (Sampled Flow) uses packet sampling to provide a statistical representation of all network traffic, not just IP.

Identifying traffic patterns that deviate from an established 'baseline' (e.g., a database suddenly sending GBs of data to an unknown external IP), which could indicate a breach.

Identifying an attacker's attempts to move from one compromised system to others within the internal network, often detected by unusual internal RDP, SSH, or SMB traffic.

Identifying the 'heartbeat' traffic or data exfiltration signals sent from compromised internal hosts to an attacker's external server.

A security solution that enforces policy on devices attempting to access the network (e.g., checking if an employee's laptop has an up-to-date antivirus before allowing it to connect).

An IEEE standard for port-based Network Access Control. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

A Layer 2 security feature on switches that limits the number of MAC addresses allowed to connect to a specific physical port, preventing MAC flooding attacks.

A security method where the network checks the hardware address (MAC) of a device and only allows pre-approved addresses to connect. It is easily bypassed via spoofing.

An attack where an attacker sends fake ARP messages to link their MAC address with the IP address of a legitimate server/gateway. Prevention includes Dynamic ARP Inspection (DAI).

A method of attacking networked resources on a restricted VLAN by sending packets to a port that is not normally accessible from a given end-user terminal.

Encrypting data while it is stored on physical media (disks, tapes). This protects data even if the physical hardware is stolen or the cloud provider's storage is compromised.

Protecting data as it moves across a network (like the internet or a VPC) using protocols like SSL/TLS or IPsec to prevent eavesdropping and 'Man-in-the-Middle' attacks.

Protecting data while it is being processed in RAM or CPU. This is the newest frontier of encryption, often implemented via Confidential Computing and Trusted Execution Environments (TEEs).

Symmetric uses the same key for both encryption and decryption (Fast, e.g., AES). Asymmetric uses a public key to encrypt and a private key to decrypt (Slower but secure for key exchange, e.g., RSA).

Advanced Encryption Standard. The industry standard for symmetric encryption. It is highly secure and efficient, used for disk encryption and database security worldwide.

Rivest-Shamir-Adleman. A widely used asymmetric encryption algorithm based on the difficulty of factoring large prime numbers. It is primarily used for secure key exchange and digital signatures.

The length of the key used in the algorithm. A larger key size (like 256-bit) provides significantly more security against brute-force attacks than a smaller one (like 128-bit).

These are variants of the Advanced Encryption Standard. AES-128 uses a 128-bit key and is very fast. AES-256 uses a 256-bit key, providing a much higher security margin, often required for 'Top Secret' classification and protection against future quantum computing attacks.

Transport Layer Security (and its predecessor SSL) are cryptographic protocols designed to provide communications security over a computer network. It ensures that the data sent between a client and a server is encrypted and authenticated.

TLS 1.3 is the latest version. It is faster (reducing handshakes) and more secure than TLS 1.2 because it removed outdated, weak cryptographic algorithms (like MD5 and SHA-1) and mandates 'Perfect Forward Secrecy'.

A digital document that binds a public key to an identity (a domain name or organization). It is used by a client to verify that the server it is communicating with is legitimate.

A framework of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.

A trusted third-party organization (like DigiCert or Let's Encrypt) that issues digital certificates. The CA vouches for the identity of the certificate holder.

CA-signed certificates are trusted by browsers by default. Self-signed certificates are signed by the same entity that created them; they are free and useful for internal testing but cause 'Not Secure' warnings in browsers.

A list of certificates used to authenticate an entity. It starts with the server certificate, follows through one or more intermediate CAs, and ends at a 'Root CA' certificate that is pre-installed in the browser's trust store.

Methods to cancel a certificate before it expires (e.g., if the private key is stolen). CRL is a published list of revoked serial numbers. OCSP is a real-time protocol for checking a specific certificate's status.

A security mechanism where an application is hardcoded to only trust a specific certificate or public key, ignoring the standard CA trust store. This prevents Man-in-the-Middle attacks from rogue CAs.

A feature of specific key agreement protocols that ensures that if a server's long-term private key is compromised in the future, the session keys used for past communications remain secure.

Encryption is a two-way function (you can decrypt the data). Hashing is a one-way cryptographic function (you cannot reverse it to get the original data); it is used to verify data integrity.

Standard hashing algorithms (Secure Hash Algorithm). The numbers represent the length of the resulting hash in bits. SHA-256 is the current standard for security and data integrity verification.

An older hashing algorithm that is now considered broken because of 'Collision Attacks' (two different inputs producing the same hash). It should never be used for security purposes.

Adding random data (a 'salt') to a password before hashing it. This ensures that two users with the same password have different hashes, protecting against 'Rainbow Table' attacks.

A specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key. It is used to verify both data integrity and authenticity.

A mathematical scheme for demonstrating the authenticity of digital messages or documents. It uses asymmetric encryption (private key to sign, public key to verify) to provide non-repudiation.

A type of digital signature used by software developers to sign their applications, ensuring that the code has not been altered or corrupted since it was signed by the author.

The process of replacing sensitive data with a non-sensitive equivalent, known as a 'token'. The original data is stored in a secure vault. Unlike encryption, there is no mathematical relationship between the token and the data.

The process of obscuring specific data within a database or UI (e.g., showing only the last 4 digits of a credit card). It allows users to see enough data to perform their job without exposing sensitive info.

Anonymization permanently removes PII (irreversible). Pseudonymization replaces PII with an alias (reversible with a key). GDPR considers pseudonymized data still as personal data.

Any information that can be used on its own or with other information to identify, contact, or locate a single person (e.g., Name, Email, SSN, IP Address).

Health-related information that is created, used, or disclosed in the course of providing healthcare services and is protected under HIPAA.

A set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment (e.g., encrypting cardholder data).

The stages an encryption key goes through: Generation, Storage, Distribution, Rotation, Revocation, and Destruction.

The process of using a cryptographically secure random number generator (CSPRNG) to create a new, unpredictable key for use in encryption.

Ensuring that encryption keys are never stored alongside the data they encrypt. They should be stored in a Hardware Security Module (HSM) or a managed Key Management Service (KMS).

The practice of periodically retiring an old encryption key and generating a new one. This limits the amount of data encrypted with a single key, reducing the impact if a key is compromised.

The process of permanently deleting a key so that the data encrypted with it can never be decrypted again. This is the ultimate way to 'delete' data in the cloud (Crypto-shredding).

A security model where the cloud customer generates and manages their own keys in their local HSM and uploads them to the CSP's KMS to be used for cloud services.

The most restrictive model where the keys and the actual encryption process remain entirely on the customer's premises. The CSP never sees the key, even in its own KMS.

The cloud provider's version of a key that you control (rotate, enable/disable) but is hosted on their infrastructure. It provides a balance between control and ease of use.

A strategy where data is encrypted with a unique Data Key, and then that Data Key is encrypted with a Master Key. It allows for efficient encryption of massive files without sending the data to the KMS.

Transparent Data Encryption. It encrypts the entire database file at the storage level, meaning it is 'transparent' to the application; the app doesn't need to know the data is encrypted.

Encrypting specific sensitive columns (e.g., 'CreditCardNumber') within a table. This provides finer control but is more complex to implement and can impact search performance.

Encrypting data at the application layer before it ever reaches the database. This ensures that even database administrators cannot see the sensitive data in plaintext.

Similar to field-level encryption; the encryption logic resides within the application code. This provides the highest level of security but requires careful key management within the app.

A system of communication where only the communicating users can read the messages. The data is encrypted on the sender's device and only decrypted on the recipient's device.

S/MIME uses a centralized CA for certificates. PGP uses a 'Web of Trust'. Both ensure that email content is encrypted and cannot be read by email servers or hackers in transit.

Encrypting every bit of data that goes on a disk, including the operating system and user files. It protects against physical theft of a laptop or hard drive.

Encrypting individual files or folders rather than the entire disk. This allows for specific permissions to be set for different users on the same machine.

The process of encrypting backup files before they are sent to off-site storage. This ensures that even if the backup media is lost, the data remains inaccessible.

A method that allows two parties to jointly establish a shared secret key over an insecure channel (like the internet) without any prior knowledge of each other.

The process of securing the entire container lifecycle: from building images and managing registries to the runtime security of the orchestration platform (Kubernetes).

1. Use Minimal Base Images (Alpine). 2. Never run as root (use USER directive). 3. Use Multi-stage builds to exclude dev tools. 4. Scan images for vulnerabilities. 5. Limit resource usage (CPU/RAM).

The process of analyzing a container image's layers to identify known vulnerabilities (CVEs) in libraries, packages, and OS binaries before deployment.

Regularly checking your container images against public vulnerability databases. It should be integrated into the CI/CD pipeline so vulnerable images are blocked from deployment.

A popular, comprehensive open-source security scanner. It detects vulnerabilities in OS packages and application dependencies and scans IaC templates for misconfigurations.

An open-source project used for the static analysis of vulnerabilities in application containers (currently including Docker and rkt).

An open-source tool for deep image inspection and vulnerability scanning. It allows teams to define custom 'policies' to block images based on security criteria.

The practice of starting with a 'Clean' and 'Trusted' base image. Avoid using images from unknown sources and prefer official, verified images from Docker Hub.

Alpine is a tiny Linux distro (~5MB). Distroless contains only your application and its dependencies, no shell or package manager, drastically reducing the attack surface.

Securing the place where images are stored. This includes using RBAC to control who can push/pull and enabling automatic vulnerability scanning on all stored images.

A registry that is not publicly accessible (e.g., AWS ECR or a self-hosted Harbor). It ensures that your proprietary code and images are only accessible to your team.

The process of cryptographically signing a container image. This allows a cluster to verify that an image was created by a trusted source and hasn't been tampered with.

A feature in Docker that allows you to use digital signatures for data sent to and received from remote Docker registries, ensuring the integrity and origin of images.

The practice of monitoring and protecting containers while they are running. It looks for unusual activities like unexpected process launches or network connections.

The use of Linux namespaces and cgroups to ensure that each container operates in its own environment and cannot see or interfere with other containers on the same host.

A high-severity attack where a malicious user 'escapes' the container boundary and gains unauthorized access to the underlying host operating system.

A container running with the `--privileged` flag has almost all the capabilities of the host root user. This makes a container escape much easier and is a major security risk.

Linux feature that allows you to grant specific 'Root' powers to a container (like `CAP_NET_ADMIN`) without giving it full root access. Best practice is to 'Drop all' and only add back what is needed.

Secure Computing Mode. It is a Linux kernel feature that restricts the system calls a container can make. A custom profile blocks dangerous syscalls (like `mount` or `ptrace`) that could be used for attacks.

A Linux kernel security module that allows you to restrict programs' capabilities with per-program profiles, preventing unauthorized access to files or network resources.

Security-Enhanced Linux. It provides a mechanism for supporting access control security policies through the use of labels on processes and files.

A multi-layered approach: 1. Cloud (Infra). 2. Cluster (API/Node). 3. Container (Image). 4. Code (App).

Role-Based Access Control. It determines who (User/ServiceAccount) can do what (Verbs like 'get', 'list', 'delete') on which resource (Pods, Services) within the cluster.

A type of identity used by Pods to authenticate with the Kubernetes API server so they can perform automated tasks inside the cluster.

Using Namespaces to logically divide cluster resources. While they don't provide strong security by themselves, they are the foundation for applying RBAC and Network Policies.

Specifies how groups of pods are allowed to communicate with each other and other network endpoints. It acts as a Layer 3/4 firewall for your internal pod traffic.

A legacy K8s resource that controlled security sensitive aspects of pod specification. It was deprecated in 1.21 and removed in 1.25 in favor of Pod Security Admission.

Standardized security profiles: Baseline (minimal restrictions, prevents known escapes) and Restricted (strict hardening for security-critical apps).

A built-in K8s admission controller that evaluates Pods against the Pod Security Standards (Privileged, Baseline, Restricted) at the namespace level.

The native way to store sensitive info in K8s. Note: By default, K8s secrets are only base64 encoded, not encrypted, unless 'Encryption at Rest' is configured.

A K8s operator that integrates with external secret managers (like AWS Secrets Manager or HashiCorp Vault) to automatically sync and inject secrets into the cluster.

Securing the 'Brain' of K8s. Measures include using TLS for all traffic, disabling anonymous access, and using Admission Controllers to validate all requests.

A piece of code that intercepts requests to the K8s API server prior to persistence of the object, but after the request is authenticated and authorized. it can 'Validate' or 'Mutate' requests.

A type of admission controller that can accept or reject a request based on custom business logic (e.g., 'Reject this pod if it doesn't have a specific label').

A type of admission controller that can modify the request before it is processed (e.g., automatically adding a sidecar container to every new pod).

A policy engine for Kubernetes that uses the 'Rego' language. It allows you to enforce complex security and compliance rules that K8s native RBAC cannot handle.

A policy engine designed specifically for K8s. Unlike OPA, it uses standard K8s YAML for policy definitions, making it much easier for K8s engineers to use.

An open-source runtime security tool for K8s. It monitors kernel calls to detect abnormal activity (e.g., a pod opening a shell or overwriting `/etc/shadow`) and triggers alerts.

Records all events happening in the API server. it answers 'Who did what, where, and when'. It is the primary data source for cluster-level incident investigation.

The practice of scanning cluster configurations (YAML/Helm charts) for security flaws like 'Container running as root' or 'Insecure Service Type'.

A tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

A tool that hunts for security weaknesses in Kubernetes clusters. It can run from outside the cluster, from a machine inside the cluster, or as a pod within the cluster.

Using a layer like Istio to handle security at the application level, providing features like automated mTLS, fine-grained access control, and request-level tracing.

1. mTLS by default. 2. Authentication (JWT validation). 3. Authorization Policies (Service-to-service rules). 4. Egress Gateway (controlling outgoing traffic).

A protocol where both the client and server verify each other's certificates. it ensures that all internal traffic is both encrypted and authenticated.

A lighter service mesh than Istio. it is famous for providing 'Zero-config' automatic mTLS between all services in the cluster without needing complex configuration.

Securing the entry point of the cluster. Best practices include SSL termination, integration with a WAF, and using 'Rate Limiting' to prevent DDoS.

Restricting the external IP addresses and domains that pods are allowed to connect to. This prevents a compromised pod from sending data to an attacker's C2 server.

The process of identifying potential threats to the cluster (e.g., compromised worker node, rogue container, malicious admin) and mapping them to specific security controls.

Ensuring the integrity of every component that ends up in the cluster: from the source code and the base image to the Helm chart and the CI/CD pipeline used to deploy it.

A technology that supports threat detection, compliance and security incident management through the collection and analysis (both near real-time and historical) of security events from a wide variety of event and contextual data sources.

A solution that helps security teams manage and respond to alerts by automating workflows (Playbooks). For example, if a SIEM detects a malicious IP, the SOAR automatically blocks it in the firewall.

SIEM is for detection and analysis (finding the needle in the haystack). SOAR is for response and orchestration (handling the incident once found).

The process of collecting logs from many different sources (VMs, Firewalls, Apps, Cloud Services) and centralizing them into a single location for analysis.

The logic used by a SIEM to link related events from different sources to identify a single attack (e.g., linking a failed login on a VM with a suspicious API call in CloudTrail).

The continuous observation of logs and metrics to identify unusual patterns that may indicate a security threat or policy violation.

Information about existing or emerging threats. it includes data on threat actors, their tactics, techniques, and procedures (TTPs), and indicators of compromise (IOCs).

IOCs are forensic evidence of a potential intrusion on a host or network. Common examples include specific IP addresses associated with C2 servers, file hashes of known malware, or unusual domain names.

A proactive security exercise where analysts search through networks to detect and isolate advanced threats that have evaded existing security solutions. It is 'hypothesis-driven' rather than alert-driven.

UEBA uses machine learning to build a baseline of normal behavior for users and entities (like servers or service accounts). It flags anomalies, such as a user suddenly accessing thousands of files at 3 AM from a new location.

The identification of data points, items, or events that do not conform to an expected pattern or other items in a dataset. In security, this helps find 'unknown unknowns' that rules-based systems might miss.

The process of establishing a 'normal' state of operation for a cloud environment (e.g., standard API call volume, typical CPU usage). Monitoring then focuses on deviations from this baseline.

The mechanism that notifies security personnel when a specific condition or event occurs that requires attention. Effective alerting must be actionable and timely.

Alert fatigue occurs when security analysts are overwhelmed by a high volume of alerts, leading to missed threats. It is reduced by 'Alert Tuning', deduplication, and automating low-risk responses via SOAR.

The ongoing process of refining security rules to minimize false positives while ensuring critical threats are still captured. It involves adjusting thresholds and adding exclusions for legitimate traffic.

1. False Positive: System incorrectly flags legitimate activity as a threat. 2. False Negative: System fails to detect an actual threat (the most dangerous scenario).

An occurrence that actually or potentially results in adverse consequences to an information system or the information the system processes, requiring a formal response.

An Event is any observable occurrence in a system (e.g., a login). An Incident is an event that has a negative impact on security (e.g., a successful unauthorized login).

Categorizing incidents (Low, Medium, High, Critical) based on their impact on the business, the sensitivity of the data involved, and the scope of the compromise.

A documented set of instructions to help IT staff detect, respond to, and recover from network security incidents. It defines roles, communication channels, and technical steps.

The NIST lifecycle includes four phases: 1. Preparation. 2. Detection & Analysis. 3. Containment, Eradication, & Recovery. 4. Post-Incident Activity.

The most important phase where the organization builds the capability to respond. it involves training staff, implementing tools, and creating playbooks *before* an incident occurs.

Determining if an incident has occurred and its scope. This involves analyzing logs (SIEM), verifying alerts, and identifying the attack vector.

The process of stopping the attack from spreading further. In the cloud, this might involve isolating an EC2 instance by changing its Security Group to block all traffic.

Removing the cause of the incident. This involves deleting malware, disabling compromised accounts, and patching the vulnerabilities that allowed the attacker entry.

Restoring systems to normal operation. This includes verifying that systems are clean, restoring from clean backups, and increasing monitoring for a period of time.

A meeting held after an incident to document exactly what happened, how the team responded, and what improvements are needed in the IRP or technical controls.

Common roles include the Incident Commander (leader), Technical Lead (investigator), Legal/PR (external communication), and Executive Sponsor.

A set of specific, step-by-step instructions for responding to a particular type of threat (e.g., a Phishing playbook, a Ransomware playbook).

While often used interchangeably with playbooks, runbooks are usually more granular technical instructions (e.g., the specific CLI commands to rotate a KMS key).

Defines who needs to be notified (Internal, Customers, Regulators) and when. In the cloud, this is critical for meeting breach notification timelines like GDPR's 72-hour rule.

Legal obligations to inform affected parties when their sensitive data has been compromised. Failure to notify within the legal window can lead to massive fines.

The application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody.

The chronological documentation that records the sequence of custody, control, transfer, and analysis of physical or electronic evidence. It is vital for evidence to be admissible in court.

The process of ensuring that data is not altered after an incident. In the cloud, this involves taking snapshots of EBS volumes and locking CloudTrail logs.

Analyzing a computer's RAM to find evidence that is not stored on the disk, such as active network connections, running processes, and encryption keys.

Examining the physical or virtual storage media to recover deleted files, analyze system logs, and find evidence of malicious software installation.

Monitoring and analyzing computer network traffic for the purpose of information gathering, legal evidence, or intrusion detection.

Challenges include: 1. Lack of physical access to hardware. 2. Ephemeral resources (containers disappearing). 3. Multi-tenancy issues. 4. Reliance on provider-provided logs.

The study or process of determining the functionality, origin, and potential impact of a given malware sample such as a virus, worm, or trojan horse.

Static involves examining the code without running it (fast/safe). Dynamic involves executing the malware in a controlled environment to observe its behavior (accurate/risky).

A secure, isolated virtual environment where suspicious files can be executed without risking the rest of the network, allowing researchers to observe behavior.

The process of deconstructing malware to understand its internal logic, command and control (C2) protocols, and functionality, often using tools like Ghidra or IDA Pro.

Tools that collect, correlate, and analyze threat data from multiple sources in real-time to provide actionable intelligence to security teams.

A globally accessible knowledge base of adversary tactics and techniques based on real-world observations. it is used as a foundation for the development of specific threat models.

Developed by Lockheed Martin, it describes the stages of a cyberattack: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.

A model for mapping intusion events across four core features: Adversary, Infrastructure, Capability, and Victim.

The practice of following a set of external or internal rules, regulations, and guidelines to ensure the security of data and systems. In the cloud, this often involves third-party audits.

A structured set of guidelines and best practices that organizations use to manage their security risk and demonstrate their security posture to regulators and customers.

Type I assesses the design of controls at a specific point in time. Type II assesses the operational effectiveness of those controls over a period of time (usually 6-12 months).

An international standard on how to manage information security. it details requirements for establishing, implementing, maintaining and continually improving an ISMS.

A voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity-related risk. its core consists of five functions: Identify, Protect, Detect, Respond, and Recover.

The Center for Internet Security's list of 18 critical security actions that every organization should take to defend against the most common and damaging cyberattacks.

Twelve requirements for protecting cardholder data, ranging from maintaining firewalls to regularly testing security systems and processes.

A subset of HIPAA that establishes national standards to protect individuals’ electronic personal health information (e-PHI).

Requires data protection by design, user consent, data portability, and the appointment of a Data Protection Officer (DPO) for large-scale processing.

A state statute intended to enhance privacy rights and consumer protection for residents of California, providing the right to know what personal data is being collected.

The Federal Risk and Authorization Management Program (FedRAMP) is a U.S. government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.

The Federal Information Security Management Act (FISMA) requires U.S. federal agencies to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency.

The practice of codifying compliance requirements into automated scripts and tools. This allows for continuous auditing and ensures that any resource that deviates from the required security baseline is automatically flagged or remediated.

The use of high-level code to manage and automate security and operational policies. Tools like Open Policy Agent (OPA) allow you to write policies (e.g., 'no public S3 buckets') that are enforced during CI/CD or at runtime.

A minimum set of security controls and configurations that must be applied to all cloud resources within an organization to maintain a consistent and acceptable level of risk.

Best practices created by the Center for Internet Security specifically for cloud providers (AWS, Azure, GCP). They provide step-by-step guides to hardening services like IAM, logging, and networking.

Instructions for securing a system by reducing its surface of vulnerability, which involves removing unnecessary software, disabling unused services, and tightening local security settings.

A repository that acts as a data warehouse, storing information about an IT environment's hardware and software assets (Configuration Items) and the relationships between them.

A complete and up-to-date list of all cloud resources (VMs, buckets, databases, users). You cannot secure what you do not know exists; therefore, asset inventory is the first step in any security program.

A continuous process that includes discovery, prioritization, and remediation of vulnerabilities. It involves automated scanning, patch management, and reporting to stakeholders.

The process of distributing and applying updates to software. In the cloud, this often involves updating 'Golden Images' (AMIs) or automating OS updates via tools like AWS Systems Manager Patch Manager.

The automated process of inspecting systems for known security weaknesses. Cloud-native tools like Amazon Inspector or Azure Defender automatically scan workloads for CVEs.

A Vulnerability Assessment identifies and reports known weaknesses. A Penetration Test goes further by attempting to actively exploit those weaknesses to see how deep an attacker could get.

Red Team acts as the attacker, using real-world techniques to find holes. Blue Team acts as the defender, maintaining security controls and responding to the Red Team's 'attacks'.

A collaborative security methodology where Red and Blue teams work together in real-time to share knowledge and improve detection and response capabilities simultaneously.

The integration of security practices into the DevOps software development workflow. It emphasizes 'Security as Code' and ensures that security is a shared responsibility from the start of the project.

The practice of moving security testing earlier in the software development lifecycle (to the 'left' of the timeline). It aims to find and fix vulnerabilities during the coding phase rather than after deployment.

Automating security checks within the build and deployment process. This includes linting code, scanning for secrets, performing static analysis (SAST), and checking dependencies (SCA).

A testing methodology that analyzes source code, byte code, or binaries for security vulnerabilities without executing the code. It is used early in the SDLC.

A testing methodology that interacts with a running application to find vulnerabilities like SQL injection or Cross-Site Scripting. It is typically performed in staging or production-like environments.

The process of identifying open-source components and their known vulnerabilities within an application's codebase. it helps manage risks associated with third-party libraries.

A subset of SCA that specifically focuses on checking the 'manifest' files (like package.json or requirements.txt) for libraries with known CVEs.

Checking third-party libraries to ensure their licenses (e.g., MIT, GPL) align with company policy to avoid legal risks and intellectual property issues.

The practice of scanning IaC files (Terraform, CloudFormation) for security misconfigurations (like unencrypted buckets) before the infrastructure is actually provisioned.

Using tools like Checkov, Tfsec, or Terrascan to analyze Terraform manifests for security best practices and compliance violations.

Using tools like cfn-nag to look for patterns in CloudFormation templates that may indicate insecure infrastructure, such as overly permissive IAM policies.

The use of automated scripts and tools to perform repetitive security tasks, such as weekly vulnerability scans or triggering a WAF block based on high error rates.

A structured process to identify, quantify, and address the security risks associated with an application or system. It answers: 'What can go wrong?' and 'What are we going to do about it?'

A framework for identifying threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

The process of identifying hazards and risk factors that have the potential to cause harm, analyzing the risk associated with that hazard, and determining appropriate ways to eliminate or control the hazard.

A central document used as a risk management tool to track issues and address them before they become problems. It includes the risk description, impact, probability, and mitigation plan.

Four main approaches: Avoidance (don't do it), Reduction (apply controls), Transference (buy insurance), and Acceptance (business decision to live with the risk).

1. Public Subnet: Load Balancer + WAF. 2. Private Subnet: Web/App Servers (Access only from LB). 3. Database Subnet: RDS (Access only from App subnet). 4. IAM: Use Roles for EC2. 5. Encryption: KMS for S3/RDS. 6. Monitoring: CloudTrail + GuardDuty.

Use Identity Federation (Okta/AD) for SSO. Map users to groups based on job function. Assign IAM Roles to these groups. Use Permissions Boundaries to limit maximum access and Access Analyzer to periodically prune unused permissions.

1. Source: Secret scanning (TruffleHog). 2. Build: SAST (SonarQube) + SCA (Snyk). 3. Registry: Vulnerability scan on push (ECR). 4. Deploy: IaC scan (Checkov) + Binary Authorization. 5. Runtime: Monitoring (Falco).

Detection: GuardDuty (IAM anomalies) + CloudWatch (S3 traffic spikes). Response: 1. Containment (Revoke session/Isolate resource). 2. Forensics (Volume snapshots). 3. Eradication (Patch vulnerability). 4. Notification (Legal/Customers).

Implement a Service Mesh (Istio/Linkerd) to enforce mTLS (Mutual TLS) for encryption and identity. Use Authorization Policies to define which service can talk to another (Zero Trust).

Use a Multi-Region strategy. 1. Data replication (RDS Cross-region). 2. Infrastructure as Code (Terraform) to spin up resources in the backup region. 3. Use Route 53 Failover routing to redirect traffic automatically.

1. Eliminate VPNs (use IAP or App Connector). 2. Device Trust (Healthy laptops only). 3. Identity-based perimeters. 4. Continuous verification of every request based on context (IP, Time, Behavior).

1. Minimal IAM Execution Role. 2. Function-level timeout. 3. API Gateway auth (Cognito/JWT). 4. Environment variable encryption (KMS). 5. Scan dependencies for CVEs during build.

1. At Rest: KMS with Customer Managed Keys (CMK). 2. In Transit: TLS 1.3 enforced. 3. In Use: Confidential Computing (AWS Nitro Enclaves). 4. Client-side: Encrypt before uploading to S3 for ultra-sensitive PII.

1. Disconnect compromised instances. 2. Use S3 Object Lock (WORM) to ensure backups couldn't be deleted. 3. Rotate all credentials. 4. Restore from the most recent immutable snapshot.

1. Use an Authorizer (Cognito/Lambda). 2. Enable Throttling/Rate Limiting. 3. Use WAF to block common exploits. 4. Validate all incoming request schemas.

Strictly isolate the Cardholder Data Environment (CDE). Use Transit Gateway or VPC Peering with restrictive NACLs. Ensure no direct internet access from CDE. Log all traffic using Flow Logs.

1. API Audit Logs to SIEM. 2. Falco for runtime threat detection. 3. Prometheus for resource anomalies. 4. Kube-bench for configuration audits against CIS.

Use AWS Direct Connect or Azure ExpressRoute for a private line. Layer an IPsec VPN over that line for encryption in transit. Use VPC Endpoints to keep service traffic private.

Use a central IdP (Okta/Entra ID). Connect AWS via SAML 2.0 and Azure/GCP via OIDC. Map centralized groups to cloud-specific roles to maintain a single source of truth for identities.

Use CloudTrail to see 'who' did 'what'. Look for `ConsoleLogin` from unusual IPs or `AssumeRole` spikes. Cross-reference with GuardDuty alerts and use AWS Detective to visualize the API call chain.

Use AWS Config or Azure Policy. Define rules (e.g., 'no public buckets'). Set up EventBridge to trigger a Lambda function for auto-remediation (e.g., making the bucket private) upon violation.

Use AWS Backup with a cross-account/cross-region backup vault. Encrypt backups using a separate KMS key. Implement Object Lock for immutability and perform quarterly restore drills.

1. Use X.509 certificates for device-unique authentication. 2. Implement IoT Core policies (AWS) or IoT Hub SAS tokens for least privilege. 3. Use an IoT Gateway to bridge legacy devices. 4. Enable Over-the-Air (OTA) updates for patching. 5. Monitor for anomalies using services like AWS IoT Device Defender.

1. Data Lake encryption (KMS). 2. Fine-grained access control (Lake Formation). 3. Data Masking for PII. 4. VPC isolation for Spark/EMR clusters. 5. Audit all queries using CloudTrail or service-specific logs (e.g., Athena audit logs).

1. Establish cross-functional team. 2. Automated Detection (GuardDuty/Security Center). 3. Isolation Playbooks (Lambda to revoke IAM sessions or snapshot volumes). 4. Forensics in a clean-room environment. 5. Post-mortem and automated rule updates.

1. Use IAM Permissions Boundaries. 2. Restrict `iam:PassRole` usage. 3. Enforce MFA for all console/CLI access. 4. Monitor for `UpdateAssumeRolePolicy` or `CreateNewUser` events. 5. Perform regular IAM access reviews.

1. Encrypt S3 training data. 2. Use VPC-only mode for SageMaker/Vertex AI to prevent internet egress. 3. IAM restriction on model deployment APIs. 4. Scan training containers for vulnerabilities. 5. Implement Data Lineage to track source integrity.

1. Multi-tenancy isolation (Row-level security or DB-per-tenant). 2. Federated Identity (SAML/OIDC). 3. WAF and API Gateway for edge protection. 4. Encryption with tenant-specific keys (BYOK). 5. Customer-accessible audit logs.

1. Integrated vulnerability scanning in CI/CD. 2. Admission Controllers to block non-compliant pods. 3. Runtime Protection (Falco). 4. Network policies for micro-segmentation. 5. Read-only root file systems for containers.

Use AWS Secrets Manager or Azure Key Vault with automated rotation functions. The application should fetch the secret at runtime from the API, and the vault should automatically update the backend database credentials without downtime.

1. Use Global Tables (DynamoDB) or Aurora Global DB. 2. Replicate IAM roles and KMS keys. 3. Use Route 53 DNS Failover. 4. Infrastructure as Code (Terraform) for identical environments. 5. Test with 'Game Day' simulations.

1. Implement Depth Limiting to prevent resource exhaustion. 2. Query cost analysis. 3. Authentication via JWT/Cognito. 4. Field-level authorization. 5. Introspection disabled in production to hide the schema.

Netflix relies heavily on automation and 'Security Monkey' (now part of a wider ecosystem). They use a strategy called Security by Design, where developers use pre-approved, hardened AMIs and infrastructure templates that automatically include security logging and identity controls.

Use CloudFront with OAI/OAC to protect S3 origins. Implement WAF at the edge. Use KMS for media encryption at rest. Leverage IAM roles for EC2/ECS to handle transcoding permissions and ensure API endpoints use Cognito for user auth.

Enable Security Hub in all regions. Designate an Administrator Account in AWS Organizations. Enable automated checks for AWS Foundational Security Best Practices and CIS. Integrate findings with a ticket system (Jira) or Slack via EventBridge.

Amazon follows a Zero-Mistrust and Defense-in-Depth model. They emphasize 'Automated Reasoning' to verify IAM policies and utilize a 'Cell-based architecture' to contain blasts and limit the impact of any single failure or breach.

Airbnb uses strict network isolation and PII detection. They leverage AWS Macie to discover sensitive data and use internal services (like their 'Hodor' identity service) to manage complex permissions across a service-oriented architecture.

Use the Organizations integration. Delegate GuardDuty administration to the Security account. Enable GuardDuty for all member accounts with one click. Use S3 to archive logs globally for forensic analysis.

Deploy Control Tower to set up a multi-account Landing Zone. Implement Mandatory Guardrails (e.g., 'Disallow public S3 access') and monitor for drifts. Use the Dashboard to view organization-wide compliance status.

The breach involved a Server-Side Request Forgery (SSRF) attack on a misconfigured WAF/EC2. Lessons: 1. Transition to IMDSv2 (requires tokens). 2. Implement strict IAM Least Privilege (WAF should not have S3 access). 3. Monitor CloudTrail for unusual `Sync` commands.

Lyft uses an internal service mesh (Envoy) to handle all service-to-service communication with mTLS. They authenticate users via an Identity Provider and utilize context-aware access to determine what resources can be touched.

Deploy AWS Config with a set of Managed Rules. Use CloudWatch Events to trigger a Lambda function when a rule becomes 'NON_COMPLIANT'. The Lambda can either alert the team or automatically remediate (e.g., rotate a key).

Microsoft uses a model called 'Assume Breach'. They utilize Red Teaming, physical security, and strict logical isolation. They also utilize the Microsoft Intelligence Security Graph, which analyzes trillions of signals to block threats.

1. Integrate AKS with Azure AD. 2. Use Azure CNI for networking. 3. Enforce Azure Policy for Kubernetes. 4. Use Private Link to access the API server. 5. Enable Defender for Containers for runtime threat detection.

Connect data sources (Azure AD, O365, AWS). Use Analytics Rules to detect anomalies. Create Workbooks for visualization. Automate responses using Logic Apps (Playbooks).

Xbox uses Azure PlayFab for secure identity and massive-scale DDoS protection via Azure Front Door and DDoS Protection service. They focus on credential safety and child-safety compliance (COPPA).

Walmart utilizes a hybrid-cloud strategy. They focus on VNet segmentation and 'Software-Defined Perimeters' to ensure that e-commerce APIs are isolated from physical store inventory systems.

Enable Defender for Cloud for all subscriptions using Azure Policy. Focus on Secure Score improvements. Implement 'Auto-provisioning' of the Log Analytics agent. Enable 'Enhanced Security' for SQL and Storage.

Install the Arc agent on on-premise servers. This allows you to apply Azure Policies and RBAC to those local servers, managing them as if they were native Azure resources.

BMW focuses on Device-to-Cloud security. They use Azure IoT Hub with X.509 certificates and secure the data ingestion pipeline into Azure Data Lake using managed identities and private endpoints.

KPMG utilizes Azure Blueprints to deploy standardized environments. They use the 'Regulatory Compliance' dashboard in Defender for Cloud to track their status against ISO 27001 and local regulations.

Use Azure Front Door for global WAF and load balancing. Implement VNet Peering across regions. Use Key Vault with Geo-redundancy and Azure Site Recovery for secure workload migration during failure.

Google uses a custom-designed hardware chip called Titan to verify boot integrity. They use RPC-level authentication (LOAS) for all internal services and encrypt all data by default at the storage layer.

Enable Workload Identity. Use Shielded GKE nodes. Implement GKE Network Policies. Use Binary Authorization to ensure only scanned images are deployed to production.

Create a Service Perimeter. Add sensitive resources (e.g., BigQuery tables, S3-compatible buckets) to the perimeter. This prevents users from moving data from your project to a personal project, even with valid credentials.

Spotify uses a microservices model on GKE. They leverage Identity-Aware Proxy (IAP) to secure internal developer tools without a VPN and utilize Google's global network for DDoS protection of the streaming service.

Twitter focuses on Encryption at Scale. They utilize Cloud KMS to manage keys and ensure that data at rest in BigTable or GCS is encrypted. They also utilize VPC Flow Logs for network monitoring.

Enable SCC at the Organization level. Configure Security Health Analytics to find misconfigurations. Integrate findings with Pub/Sub to trigger automated alerts or remediation functions.

Configure a policy that requires Attestations. Integrate a vulnerability scanner (like Cloud Build) to sign images that pass. GKE will then block any container that lacks a valid signature from the authorized 'Attestor'.

Snap uses a 'No-VPN' approach for its workforce. They rely heavily on Context-Aware Access and IAP to ensure only verified employees on managed devices can access internal Snapchat production code.

Target uses VPC segmentation to separate frontend retail sites from backend logistics. They focus on PCI-DSS compliance using Google's compliance-as-code tools and Cloud Armor for edge WAF protection.

1. Use Cloud Identity for users. 2. Use Endpoint Verification for device health. 3. Deploy IAP for app access. 4. Define Access Context Manager policies to tie identity and device health together.

IBM uses a specialized management layer (IBM Cloud Pak for Security) that allows SOC analysts to query logs across AWS, Azure, and IBM Cloud without moving the data. it focuses on federated search and incident response.

1. Central IdP (Okta). 2. IaC (Terraform). 3. Secrets Management (HashiCorp Vault). 4. Unified Logging (Splunk/ELK). 5. CSPM (Wiz or Prisma Cloud) to view security across all three clouds in one dashboard.

Connect the corporate directory (AD) to a Cloud Identity Provider (IdP). Use SAML/OIDC to federate that identity into AWS Roles, Azure Service Principals, and GCP Service Accounts.

Siemens uses a 'Defense-in-Depth' approach for factory-to-cloud connectivity. They use Hardware Security Modules (HSMs) on the industrial edge to encrypt data before it is sent to the cloud (MindSphere).

Accenture uses a 'Shared Service' model. They implement a Governance Hub that monitors multiple client accounts for compliance drift and provides automated remediation playbooks across heterogeneous environments.

Deploy a CASB (like Netskope or Zscaler) to sit between the user and cloud apps. Use it to enforce Data Loss Prevention (DLP) rules (e.g., 'block upload of SSN files to any cloud drive') and monitor user behavior for anomalies.

Use Policy as Code (OPA/Rego). Write a rule once (e.g., 'every resource must have an owner tag') and enforce it via Terraform linting in the CI/CD pipeline for all cloud environments.

Being in a highly regulated sector, they focus on Sovereign Cloud and strictly audited IAM. They require 'External Key Management' (HYOK) for their most sensitive financial datasets in the public cloud.

Cisco uses Umbrella (DNS-layer security) and Cloud OnRamp to provide an 'Automated Secure Tunnel' from branch offices directly to AWS/Azure, providing firewall and IPS at the network edge.

1. Inflow: Logs from all clouds. 2. Analysis: Cloud-native SIEM (Sentinel/Sumo Logic). 3. Action: SOAR playbooks (Logic Apps/Lambda). 4. Visual: Real-time dashboards. 5. Human: 24/7 analyst team for triage.

The Root account has unrestricted access. Security measures: 1. Delete access keys. 2. Use a strong, unique password. 3. Hardware MFA. 4. Only use it for tasks that *require* it (e.g., changing billing plans).

An emergency administrative account used only when standard authentication methods (like SSO or your IdP) fail. It should be highly monitored and have its credentials stored in a physical safe.

Encryption uses an algorithm and a key to transform data (reversible). Tokenization replaces data with a randomly generated placeholder that has no mathematical value (reversible only via the vault).

1. Broken Auth on the API. 2. Over-privileged IAM roles. 3. Insecure third-party dependencies. 4. Data persistence in the container reuse (execution context leakage).

Drift happens when manual changes are made to cloud resources, deviating from the IaC template. Stop it by Disabling Console Access for production and using automated tools (Terraform Plan) to detect and overwrite manual changes.

1. Block Public Access. 2. Bucket Policies (Principal constraints). 3. KMS Encryption. 4. Access Analyzer monitoring. 5. Use S3 Object Lock for regulatory data.

The potential extent of damage if a single resource or account is compromised. It is reduced by Micro-segmentation and using multiple AWS accounts/Azure subscriptions.

By implementing Shift-Left and Self-service security. Provide developers with 'Golden Templates' that have security built-in, so they can move fast without breaking rules.

A digital signature that proves an image passed a specific check (e.g., 'Signed by Snyk' or 'Approved by QA'). It is used by Binary Authorization to ensure only verified code runs.

It binds a user to a specific server. Security risk: If that server is compromised, the attacker can maintain a persistent session with the user more easily (Session Hijacking risk).

Creating a pre-hardened OS image (AMI) with security patches, monitoring agents, and no default passwords. All new servers must be launched from this verified image.

The problem of how to give a process its first secret (e.g., a Vault token) securely. Solution: Use Cloud Identity (Instance metadata) to prove identity to the vault automatically.

Secrets generated on-the-fly for a specific user or process that expire automatically after a short time (e.g., HashiCorp Vault creating a DB user that only lasts 1 hour).

1. Use Ephemeral runners (destroyed after each job). 2. Isolate network access. 3. Use IAM roles instead of long-lived access keys. 4. Scan the runner's host for malware.

Running WAF rules at the CDN level (CloudFront/Azure Front Door) rather than the Load Balancer. it blocks malicious traffic before it even enters the cloud network, saving bandwidth.

Attacks that exploit physical leaks like timing or power consumption. In the cloud, this usually refers to 'Cross-VM' attacks where a malicious VM tries to steal data from a neighbor.

The concept that data is subject to the laws of the nation in which it is located. Cloud engineers must use Region-affinity to ensure data doesn't cross borders.

A way to 'delete' data by simply deleting the encryption key. Even if the data still physically exists on a provider's disk, it is forever unreadable and effectively gone.

1. Use `wss://` (SSL). 2. Perform Origin validation. 3. Authenticate during the initial HTTP handshake. 4. Rate-limit messages per connection.

Cold is offline (safe from ransomware but slow to restore). Warm is online/near-line (fast restore but potentially targetable by an active attacker).

Use RDS Proxy with IAM authentication. This allows Lambda to connect without a password and manages the connection pool securely.

Using OIDC allows GitHub Actions or GitLab to authenticate with AWS/Azure using a short-lived token *without* needing to store long-term secrets in the CI platform.

Tricking an admin into granting permissions by pretending to be a developer in a 'rush' or 'emergency'. Mitigation: Strict 'Approval Workflow' for all IAM changes.

Recording the entire CLI/SSH/RDP session of an administrator. If a breach occurs, the security team can play back the session to see exactly what the attacker did.

When the WAF blocks a legitimate user because their query looks like an attack (e.g., a legitimate SQL command in a developer tool). Solution: Rule exclusions or learning-mode.

A business model where a third-party provider integrates their security services into your cloud (e.g., using Okta for IAM or CrowdStrike for endpoint protection).

1. Use HTTPS. 2. Implement Secret Signatures (HMAC) to verify the sender. 3. IP Whitelisting of the provider. 4. Request timestamp validation to prevent replay attacks.

Filtering web requests at the DNS level. it prevents users from even resolving the IP of a known malware or phishing site, protecting the network before the connection starts.

Just-in-Time access. The firewall port (e.g., SSH) is closed by default. When an admin needs access, they request it via a portal; the port opens for that specific IP for 1 hour, then closes.

Moving from 'Gatekeeper' to 'Enabler'. You build the automated guardrails and security platforms (DevSecOps) that allow developers to deploy code safely and autonomously at scale.