Cloud Security Guides

In 2011, security researcher Christopher Hadnagy published The Art of Human Hacking, codifying what attackers had known for decades: the easiest way into a system is not through the firewall — it is through the person sitting in front of it. Pretexting, phishing, impersonation, authority exploitation — social engineering bypasses technical controls by targeting trust itself. Thirteen years later, a new class of target has emerged. AI agents — software systems that perceive their environment, make decisions, and take actions autonomously — are being deployed across enterprise environments at pace. And attackers are discovering that these systems are susceptible to manipulation techniques that bear a striking resemblance to the social engineering playbook used against humans. ...

Artificial intelligence has moved from research curiosity to enterprise infrastructure in under five years. If you are a cloud security architect who has not yet had to secure an LLM-powered application, you almost certainly will within the next twelve months. This guide explains what large language models are, how they are built, and — critically — what the security risks are when you deploy, integrate, or expose them in your organisation. ...

Securing Kubernetes requires a defence-in-depth approach across the control plane, workload configuration, and runtime environment. The most impactful controls are RBAC hardening, network policy enforcement, pod security standards, proper secrets management, and continuous image scanning — the same domains tested in the CKS exam and exploited most frequently in real-world incidents. This guide covers each layer with practical guidance for teams running managed clusters on EKS, GKE, or AKS. RBAC: Least Privilege at the API Layer Role-Based Access Control is the primary authorisation mechanism in Kubernetes, and misconfigured RBAC remains one of the most common paths to cluster compromise. The default service account token mounted into every pod, combined with overly permissive ClusterRoleBindings, gives attackers a trivial lateral movement vector. ...

Cloud Infrastructure Entitlement Management (CIEM) is a category of security tooling designed to discover, analyse, and govern the permissions granted to identities across cloud environments. It addresses a fundamental challenge of cloud-scale operations: the near-impossibility of manually tracking who — or what — can do what across thousands of roles, policies, and resources. CIEM helps organisations enforce least privilege systematically, reducing the blast radius of compromised credentials and insider threats. ...

Data Security Posture Management (DSPM) is a security discipline focused on continuously discovering, classifying, and monitoring sensitive data across cloud environments to identify and remediate exposure risks. Unlike perimeter-focused controls, DSPM keeps the data itself at the centre of your security strategy — understanding where it lives, who can access it, and whether those access patterns are appropriate. As organisations spread data across multi-cloud storage, SaaS platforms, and data pipelines, DSPM has become an essential capability for maintaining a defensible security posture. ...

Securing AI agents with persistent access to production cloud infrastructure requires a fundamentally different threat model from traditional IAM hardening. Unlike human operators, agentic AI systems can act at machine speed, chain tool calls autonomously, and be manipulated through their input data — making conventional perimeter and identity controls insufficient on their own. Architects must layer prompt-level guardrails, strict least privilege boundaries, and runtime monitoring to safely deploy agentic workloads. ...

AWS IAM is the control plane for everything you do in AWS — misconfigured policies and poorly scoped permissions are consistently the root cause of serious cloud breaches. Securing IAM correctly means enforcing least privilege at every layer, eliminating long-lived credentials where possible, and building preventive controls that survive organisational change. The practices below are applicable at any scale, from a single-account startup to a multi-account enterprise estate. Least Privilege: More Than a Slogan Most engineers understand the principle; fewer apply it rigorously. Least privilege in AWS IAM means granting only the permissions required for a specific task, scoped to the narrowest possible set of resources, for the shortest necessary duration. ...

Zero Trust is a security architecture built on the principle of never trust, always verify. Every user, device, and connection must be explicitly authenticated and authorised before accessing any resource, regardless of whether the request originates inside or outside the corporate network. It replaces the assumption that network location confers trust — the premise at the heart of traditional perimeter security, and the assumption that credential theft, phishing, insider threats, and supply chain compromises systematically exploit. ...

Cloud Security Posture Management (CSPM) is a category of cloud security tooling that continuously monitors cloud infrastructure for misconfigurations, policy violations, and compliance drift — and automatically surfaces or remediates them. CSPM platforms assess configuration state across IaaS, PaaS, and SaaS environments against established security benchmarks including CIS Foundations, NIST 800-53, and provider-native standards such as the AWS Foundational Security Best Practices (FSBP). Findings are mapped to specific compliance controls, generating audit-ready evidence for frameworks including PCI DSS, ISO 27001, and SOC 2. Common misconfigurations CSPM detects include publicly accessible S3 buckets, overly permissive IAM roles, disabled CloudTrail logging, unencrypted databases, and security groups open to 0.0.0.0/0. ...

The shared responsibility model defines the division of security obligations between a cloud provider and its customers. The provider secures the underlying infrastructure — physical data centres, network fabric, and hypervisor — whilst the customer is responsible for everything built and configured on top of it. All three major providers use equivalent framing: AWS describes it as security of the cloud (provider) versus security in the cloud (customer); Azure and GCP draw the same distinction. ...