Cloud security
Cloud security work is mostly identity work plus disciplined defaults. The estates that hold up are the ones where a secure baseline is the path of least resistance.
Updated
Where I focus
- Landing-zone and tenancy design: environment separation, blast-radius control, policy-as-code guardrails.
- Identity: Entra ID, Conditional Access, PIM, workload identity federation, removal of long-lived secrets.
- Posture management with Defender for Cloud, Wiz.io and native tooling — triaged by exploitability.
- Detection engineering in Microsoft Sentinel: which log sources, which analytics rules, which response.
- Hardening baselines for Microsoft 365 and Google Workspace, benchmarked against the current CIS Foundations Benchmarks.
1Governance
- One control set
- Framework mapping
- Exception register
2Identity
- Central IdP
- Federation
- No long-lived keys
3Platform
- Landing zones
- Policy as code
- Network isolation
4Detection
- Central SIEM
- Per-cloud log sources
- ATT&CK coverage
Detection coverage as attacker behaviour shifts
MITRE ATT&CK's Enterprise matrix is the reference I map cloud detections against, and it keeps moving: the current release split the old Defense Evasion tactic into Stealth and Defense Impairment, and added techniques for adversaries querying public AI services and generating content for social engineering. Analytics written against last year's tactic names silently stop mapping cleanly — a periodic re-check against the current matrix is part of the job, not a one-off.
Certified coverage
- Microsoft SC-100 — Cybersecurity Architect Expert
- Microsoft AZ-500 — Azure Security Engineer Associate
- Alibaba Cloud ACA Cloud Security
- Wiz Technical Essentials
Frequently asked questions
Is multi-cloud harder to secure?
Yes, mostly because each provider names the same concept differently. A single internal control set mapped per provider removes most of the pain.
What changes most often in a hardening baseline?
Version, not existence — the CIS Foundations Benchmarks for Azure, GCP, Microsoft 365 and Google Workspace are revised regularly, and a posture tool graded against a stale version misses newly added controls.
Related
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
Microsoft Entra ID
Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.
Microsoft SC-100
SC-100 Cybersecurity Architect Expert: Zero Trust strategy, GRC alignment and security architecture across Microsoft platforms.
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
From CSPM alerts to fixes
A CSPM tool produces thousands of findings. This is the triage and ownership model that converts that backlog into a small number of changes that matter.