CSPM cheat sheet

Shared responsibility: the provider secures the cloud (physical, hypervisor, managed service internals); the customer secures what they put in the cloud (identities, data, configurations, workloads).

Service model shifts the boundary: IaaS leaves OS patching to the customer; PaaS leaves runtime and middleware to the provider; SaaS leaves only data, identity, and configuration to the customer.

Control categories: preventive (blocks), detective (detects), corrective (remediates), directive (policy), compensating (alternative to a primary control).

Defense in depth layers identity, network, compute, data, and monitoring controls so a single control failure does not expose the asset.

Trust boundaries exist at every interface: internet to edge, edge to VPC/VNet, subnet to subnet, workload to service API, and tenant to tenant.

Least privilege applies to both human identities and workload identities; standing permissions should be replaced by just-in-time or short-lived credentials.

Data classification drives control selection: public, internal, confidential, and restricted tiers determine encryption, access, and retention requirements.

Zero trust removes implicit network trust; every request is authenticated and authorized based on identity, device posture, and context, not source IP.

Authentication proves identity; authorization decides access; accounting/auditing records what happened. Federation uses SAML or OIDC to trust an external identity provider.

MFA strength tiers: something you know, have, or are; phishing-resistant factors (FIDO2/passkeys, certificate-based) are required for privileged roles in mature programs.

Role-based access control (RBAC) grants by job function; attribute-based access control (ABAC) evaluates tags/attributes at request time and scales better in dynamic cloud estates.

Privileged identity management: eligible assignments, approval workflow, time-bound activation, and access reviews for roles such as Global Administrator or Organization Admin.

Permission boundaries and service control policies (SCPs) cap the maximum permissions an identity or account can hold, even if a policy grants more.

Separation of duties prevents one identity from both authorizing and executing a sensitive change, such as requesting and approving a production deployment.

Identity governance requires periodic access recertification, joiner-mover-leaver automation, and orphaned-account cleanup to limit entitlement creep.

Conditional access evaluates signals (user, device, location, risk, app sensitivity) and enforces allow, block, or step-up authentication at request time.

Encryption states: at rest (storage/volume/database), in transit (TLS between endpoints), and in use (confidential computing enclaves, memory encryption).

Envelope encryption uses a data key to encrypt data and a key encryption key (KEK) in a KMS/HSM to protect the data key; rotate the KEK without re-encrypting bulk data.

Key management decisions: customer-managed vs provider-managed keys, rotation period, deletion/disable behavior, and regional residency of the HSM backing the key.

Data residency requires knowing where primary storage, replicas, backups, and logs physically reside; replication can silently move data across borders.

Tokenization replaces sensitive values with non-sensitive tokens mapped in a vault; format-preserving encryption keeps schema while hiding plaintext.

Data loss prevention classifies content and blocks exfiltration via email, endpoint, or SaaS APIs; it depends on accurate classifiers to avoid false positives.

Secure deletion must account for snapshots, backups, caches, and replicas; deleting the primary object does not remove derived copies.

Hashing (SHA-256) provides integrity, not confidentiality; salting and key stretching (bcrypt, Argon2) are required for password storage.

Security groups are stateful instance-level firewalls; network ACLs are stateless subnet-level filters evaluated in numbered order, so both directions must be allowed.

Public exposure paths include public IPs, load balancer listeners, storage bucket policies, and API gateways; each must be inventoried and intentionally approved.

Private connectivity options: VPC peering, transit gateway, private link/PrivateLink-style endpoints, and site-to-site VPN or dedicated interconnect.

Segmentation tiers: internet-facing, application, data, and management subnets; management planes should be reachable only through bastion or session-manager paths.

Workload hardening: minimal base images, signed artifacts, immutable infrastructure, patching cadence, and no secrets baked into images or environment files.

Container and serverless controls: image scanning, admission control, read-only root filesystems, least-privilege execution roles, and function-level network egress restrictions.

DDoS resilience combines provider edge scrubbing, autoscaling, rate limiting, and caching; WAF rules address application-layer abuse such as injection and bot traffic.

Egress filtering prevents data exfiltration and command-and-control callbacks; allowlists of destinations are stronger than blocklists of known-bad domains.

Control plane logs (API audit trails) record configuration changes; data plane logs record access to objects and requests; both are needed for investigation.

Log integrity requires centralized immutable storage, restricted write access, retention aligned to policy, and time synchronization across sources.

Detection engineering: map telemetry to threats, tune thresholds, and track false-positive rates; a signal without a response runbook is not a control.

Key cloud-native signals: root/break-glass account use, IAM policy changes, security group openings to 0.0.0.0/0, key deletion scheduling, and public bucket creation.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Cloud containment primitives: revoke sessions and rotate credentials, isolate the instance via security group, snapshot volumes for forensics, disable the access key.

Evidence handling preserves chain of custody; snapshot and export logs before remediation destroys volatile state.

Mean time to detect (MTTD) and mean time to respond (MTTR) are the primary metrics; notification timelines may be regulator- or contract-mandated.

Frameworks: ISO/IEC 27001 (ISMS), SOC 2 (trust services criteria), PCI DSS (cardholder data), HIPAA (PHI), GDPR (personal data of EU residents), NIST CSF and 800-53 (control catalogs).

Provider compliance is inherited, not transferred: an attestation covers the provider's scope only; the customer must evidence its own controls.

Risk assessment scores likelihood times impact; treatment options are mitigate, transfer, avoid, or accept, with acceptance requiring documented owner sign-off.

Cloud Security Posture Management continuously evaluates configuration against benchmarks such as CIS and remediates drift; CSPM findings feed risk registers.

Asset inventory and tagging enable scoping, ownership, and cost allocation; untagged resources are the most common audit gap.

Third-party risk: review provider attestations, subprocessor lists, data processing agreements, breach notification terms, and exit/portability provisions.

Policy as code enforces guardrails at deploy time (IaC scanning, admission control) and detects drift continuously, replacing manual review.

Audit readiness requires evidence collection, control-to-framework mapping, and defined review cadence; evidence must be dated and reproducible.