CCSO case studies

CCSO · Put your knowledge to work in context.

The Certified Cloud Security Officer (CCSO) is a vendor-neutral credential aimed at security professionals who carry responsibility for protecting cloud estates rather than only administering them. Typical candidates are security managers, cloud security architects, GRC analysts moving into cloud, and senior engineers stepping into a security ownership role. The CCSO case studies are 5 cases and about 5,051 words.

The EU Residency Contract, the Region Guardrail, and the Account Nobody Owns

NorthBridge Financial runs 62 AWS accounts under Organizations, split into Sandbox, Workloads, and Core OUs. A service control policy attached at the root denies every region except us-east-1 and us-west-2.

971 words, about 5 min 2

SCIM Deletion, a Shared Vault, and a Three-Year-Old Admin Key

Halcyon Health uses Okta federated to AWS IAM Identity Center for 1,450 employees across 41 accounts. Permission sets are assigned to Okta groups and provisioned by SCIM.

950 words, about 5 min 3

The Key Policy Rewrite That Broke Decrypt, Snapshot Copy, and a Seven-Year Archive

Veridian Analytics ingests telemetry into account A, transforms it in account B, and archives to account C. S3 objects are encrypted with a customer managed key, key-producer-A, whose policy originally contained a single statement allowing kms: to the account root principal.

1,037 words, about 5 min 4

Kyverno in Audit Mode, an Unpatchable Vendor Image, and 61 Critical CVEs

Kestrel Logistics runs 96 services on a shared EKS 1.28 cluster: 340 pods, 55 nodes, three node groups, and a legacy vendor image for yard scanning that ships only as a prebuilt tarball on a 14-month release cadence. A registry scan reports 61 images with critical CVEs; 22 of them are latest -tagged internal builds on the end-of-life node:14 base.

1,001 words, about 5 min 5

Nine Days of Stolen Keys, a Muted Mailbox, and a 14-Day SIEM

Marrow Retail has 12 AWS accounts and an organization trail delivering CloudTrail management events to a log-archive account's S3 bucket with Object Lock in compliance mode for 400 days. GuardDuty runs in 9 accounts.

1,092 words, about 5 min