Cloud Security Operations
Operate the estate
This domain is day-two work: logging and monitoring, SIEM correlation, configuration and change management, patching, vulnerability management, capacity and availability, and incident response. Baseline first - know what normal looks like per account, region, and workload, because cloud environments change constantly.
Incident response in cloud
Use a lifecycle model (prepare, detect/analyze, contain, eradicate, recover, lessons learned). Cloud specifics: you usually cannot seize hardware, so acquisition means volume snapshots, memory capture from running instances where supported, and export of API/audit logs - preserve chain of custody and remember control-plane logs live with the provider. Follow the order of volatility and act quickly, but confirm provider cooperation, jurisdiction, and notification duties before imaging.
Penetration testing and rules of engagement
Most providers require prior authorization or notification for penetration tests and prohibit testing the provider's own infrastructure. Scope, timing, and prohibited techniques belong in written rules of engagement.
DR and continuity
RTO is how long until restored; RPO is how much data you can lose. Backups need isolation (separate account and credentials, immutability) to survive ransomware. Test restores, not just backups.
Worked example
A production instance is suspected of compromise. Sequence: isolate it with a restrictive security group, snapshot its volumes, capture memory if it must keep running, then rebuild from a known-good image. In cloud, rebuilding beats cleaning because images are cheap and rootkits are not.
Trap: assuming provider logs cover everything. You must enable, centralize, and retain them - default retention is often short, and control-plane versus data-plane logs differ.