Cloud Security
Cloud Security tests whether you can find and prioritize real risk in cloud accounts: misconfiguration, identity excess, vulnerable workloads, exposed data, and insecure infrastructure as code. The key skill is ranking findings by exploitability and business impact rather than by raw count.
Core rules
- CNAPP combines CSPM for configuration, CWPP for workload protection, CIEM for permissions, and IaC scanning for pre-deployment checks.
- Effective permissions matter, not attached policies. A role is dangerous when its trust policy allows assumption and its permissions reach sensitive data.
- Attack-path analysis links a public entry point, a permissive identity, and a sensitive resource. That chain is the priority, not each finding alone.
- Agentless scanning gives broad coverage quickly; agent-based protection gives runtime behavior. Use both where the requirement is both breadth and runtime.
- Shift-left scanning catches issues before deployment, but drift means production must still be checked.
Worked example
A storage bucket is public, and an adjacent role can read all buckets and is assumable by a broad principal. Each finding might be medium alone; together they form a path from the internet to customer data. The reasoning is to remediate the trust policy and bucket exposure together, then verify effective permissions, because fixing only the bucket leaves the role as a reusable path.
Traps
Treating every misconfiguration as critical. Reading attached policy instead of effective permissions. Assuming agentless scanning sees runtime behavior. Forgetting that IaC fixes do not remove existing deployed drift. Missing cross-account trust relationships.