Cloud security

Shared responsibility, and the parts of it people assume somebody else is holding.

29 sketches

• SaaS securityThe line moved, the work did not
• Cloud IAMNobody can read this off a policy
• Cloud audit logsThe tape only goes back so far
• Cloud concentrationNine firms, one floor
• Cloud egressAll the guards face outwards
• Cloud incident responseReaching through their hatch
• Cloud key rotationRig the second line first
• Cloud keysIt leaks on the way past
• Cloud misconfigurationOne switch, one missing wall
• Cloud posture managementThe score measures the beam
• Ephemeral infrastructureSend the evidence out first
• Metadata servicesAsk the server to fetch it
• Multi-cloudOne drum, or four
• Public storageThe lever nobody was watching
• Security groupsEasy to widen, hard to narrow
• Serverless securitySqueeze one end, the other swells
• Shadow cloudFaster than anyone can write it down
• Shared responsibilityThe line is not where you think
• Tenant isolationOne wall holds the whole platform up
• Workload identityA ticket that expires by itself
• Multi-region is not the same as multi-providerTwo towns, one mains
• Autoscaling can scale a failure tooIt copied the mistake
• Managed services move responsibility, not all riskThe van takes the machines
• Private networking does not automatically mean trustedNobody asks twice
• Egress is part of the cloud security boundaryWatch the loading bay
• Snapshots can copy sensitive data silentlyThe copy keeps nothing
• Serverless still has an attack surfaceThe box went, the openings stayed
• Infrastructure as code makes mistakes reproducibleOne chipped stamp
• Resilience tests should include control-plane failureThe train runs, the levers are dead