34 lines
3.7 KiB
Markdown
34 lines
3.7 KiB
Markdown
# 8 Principles for a Secure Cloud Environment
|
||
|
||
|
||
|
||
## Metadata
|
||
- Author: [[omerxx@gmail.com]]
|
||
- Full Title: 8 Principles for a Secure Cloud Environment
|
||
- Category: #articles
|
||
- URL: https://omnivore.app/aleidk/8-principles-for-a-secure-cloud-environment-18f1fa5c54d
|
||
- Archive: https://web-archive.alecodes.page/bookmarks?bf=1&search=&title=8%20Principles%20for%20a%20Secure%20Cloud%20Environment
|
||
> [!tldr]
|
||
> On July 15th, 2019, I messed up bad. Real bad. I wanted to finish a project quickly, and show a quick POC to a customer I was working with. To make a long story short, I pushed a container, to a public repo, containing admin credentials to an AWS account.
|
||
|
||
## Highlights
|
||
CISO BS. [View Highlight](https://read.readwise.io/read/01j58cb911jv15qjeccffqxbv1))
|
||
> [!note]
|
||
> In "8 Principles For a Secure Cloud Environment," the term "CISO" refers to the Chief Information Security Officer, a role responsible for overseeing and ensuring the security of an organization's information and systems. The author implies that some principles may be perceived as excessive or overly cautious, often dismissed as "CISO BS," yet emphasizes their importance based on personal experiences with security incidents. Ultimately, the mention of CISO highlights the necessity of adopting robust security practices to mitigate risks in cloud environments, regardless of differing opinions on their complexity.
|
||
|
||
Key resources should only be placed in private subnets, effectively isolating them from direct internet access and reducing vulnerability. [View Highlight](https://read.readwise.io/read/01j58ch8xmresvx0x8mty8h37s))
|
||
|
||
The sharing of SSH keys is a common security pitfall. [View Highlight](https://read.readwise.io/read/01j58ckd7mgrh2b6f6dzmzstz9))
|
||
|
||
Utilize a dedicated secret manager to securely store and handle access to these sensitive elements, ensuring they’re encrypted and accessible only to those who truly need them. [View Highlight](https://read.readwise.io/read/01j58cm13bxanfd7bxg5th88j4))
|
||
|
||
Implement a routine where every merge commit is scanned for secret leaks and vulnerabilities using tools like [gitleaks](https://click.convertkit-mail2.com/xmuvr2v7d6h6hr6eg6pc5h03owzllbn/dpheh0h0dwroe6hm/aHR0cHM6Ly9naXRodWIuY29tL2dpdGxlYWtzL2dpdGxlYWtz). Establish strict policies to halt deployments if issues are found in the codebase or in the container images during CI. Don’t have a CI in place yet? 1. Do it! 2. Run these locally before EVERY push. [View Highlight](https://read.readwise.io/read/01j58cn5zg2y5dkd0m9emzevtw))
|
||
|
||
Move away from traditional firewall-based security for accessing internal systems remotely. Instead, adopt a VPN or, ideally, a Zero Trust framework [View Highlight](https://read.readwise.io/read/01j58cq5q1j7w0xcm19cynt6j7))
|
||
|
||
Regularly reviewing your cloud bills can help you identify unused or forgotten resources and even expose potential security threats. [View Highlight](https://read.readwise.io/read/01j58dr7eagpfs41b1g7cp42fr))
|
||
|
||
Deploying a WAF can provide a critical defense layer against numerous web-based threats. The default set of rules can cover 80% of randomly sent malicious query attempts which you can then tweak over time to block additional potentially harmful requests. [View Highlight](https://read.readwise.io/read/01j58drvb7t9633re0pfwc567x))
|
||
|
||
consider deploying containers that lack any form of shell environment. Building your containers with containers starting with `FROM: scratch` ensures that only the essential application binaries are running, thereby hardening your containers against simple intrusion attempts. [View Highlight](https://read.readwise.io/read/01j58dsmfdt50cgke4skb9d4vf))
|
||
|