Description
Book SynopsisCyberattacks continue to increase in volume and sophistication, targeting everything owned, managed, and serviced from the cloud. Today, there is widespread consensusit is not a matter ofif, but ratherwhenan organization will be breached. Threat actors typically target the path of least resistance. With the accelerating adoption of cloud technologies and remote work, the path of least resistance is shifting in substantive ways. In recent years, attackers have realigned their efforts, focusing on remaining undetected, monetization after exploitation, and publicly shaming organizations after a breach. New, innovative, and useful products continue to emerge and offer some cloud protection, but they also have distinct limitations. No single, standalone solution or strategy can effectively protect against all cloud attack vectors or identify all malicious activity. The simple fact is that the cloud is based on a company's assets being offered as services.As a result, the best security any
Table of ContentsForwardIntroduction
Chapter 1. Cloud Computing
Software as a Service
Platform as a Service
Infrastructure as a Service
Function as a Service
X as a Service
Desktop as a Service
Data Center as a Service
Managed Software as a Service
Backend as a Service
Chapter 2. Cloud Providers
Amazon Web Services
Microsoft Azure
Google Cloud Platform
Oracle Cloud
Alibaba
Other Services
Chapter 3. Cloud Definitions
Identities
Accounts
Entitlements
Privileges
Rights
Permissions
Containers
Segmentation
Microsegmentation
Instances
Chapter 4. Asset Management
Discovery
Chapter 5. Attack Vectors
Entitlements
Vulnerabilities
Hardening
Configurations
Credentials
S3 Buckets
Identities
Entitlements
API
Authentication
Certificates
Phishing
Remote Access
Supply Chain – 3rd Party MSP/MSSP
Chapter 6. Mitigations
Hardening
Patch Management
PAM
CIEM
CIAM
CWPP
Chapter 7. Regulatory Compliance
Security Questionnaires
SOC
Type I
Type II
Type III
Cloud Security Alliance
CCM
CAIQ
CIS Controls
PCI DSS
ISO
NIST
FedRamp
Chapter 8. Architectures
Zero Trust
Cloud-Native
Hybrid
Ephemeral Implementations
Accounts
Instances
Privileges
Chapter 9. Imposter Syndrome
Chapter 10. Recommendations
Chapter 11. Conclusion
