I gathered my notes for the most critical cloud security practices. I gathered input from the two top cloud providers, looked at threat data trending, and used this to support and drive my RSA Security Conference presentation. There is so much more that can be done, but these are most vital to begin on the right foot. I have included two reference resources at the end to help you go deeper down the rabbit hole. Cloud is different from bare metal environments, so you must work differently.

1. Do Good,
Find a way
Cloud security: the
most vital today
Authored by James DeLuccia
Sources: public and private discussions & content from the top cloud service
providers and companies on those platforms

2. Do Good,
Find a way
Cloud security smarts

3. Do Good,
Find a way
Reduce attack surface, and
simplify your life
● Minimize public-facing endpoints and other forms of
public access to resources (starting with everything in a
subscription/VPC)
● This includes
○ Storage accounts
○ API
○ Unnecessary open ports / sources to your public sites
○ ElastiCache or Redshift should not have public access

4. Do Good,
Find a way
Reduce annoying work, technical
debt, and future pain - automate
● Automate as much as possible and get the humans away
from the machines (lambda functions, Functions, etc..
● Build automation for everything, utilize free automation,
script everything - including how cybersecurity operates
● Dealing with legacy environments, fine, start today with
this mindset (slower but will speed up, and stops
incremental technical debt)
● Starting fresh - savage, automate

5. Do Good,
Find a way
Architect: Load Balancers at
frontend
● Utilize Load Balancers and aggressive security group /
rulesets
● Think and architect in a cloud native function, a huge
mistake folks make is designing cloud formations ;)
similar to data centers, don’t.
● Just don’t

6. Do Good,
Find a way
Just in Time - Remote Access
● Prevent / prohibit administrative remote access
● Utilize just in time and adaptive access solutions to keep
a limited attack surface and ensuring your developers
have the access required to build product

7. Do Good,
Find a way
Cloud security that’ll save
your rear end

8. Do Good,
Find a way
Use Cloud Native Tools, they are
free
● Cloud Providers make an immense amount of tools and
intelligence that is very practical to operating clean and
healthy online - use them
● Defaults are not always great, so take 5 mins and double
check what those options mean
○ AWS and Azure are widely different here, so be smart
○ AWS has more encryption and better security on by default

9. Do Good,
Find a way
Verify your credentials & keys
aren’t on public REPOs
● Great developers use REPOs (such as GitHub)
● This is where code is checked-in
● Scan and verify that your developers are not
inadvertently pushing your API credentials to public
spaces (which will cause you to be completely destroyed
online)

10. Do Good,
Find a way
Defeat account takeover &
ransomware
● Consider a ‘bunker’ account for backups. This is a
completely off-the-grid account, no IAM federation, and
it’s where all critical backups get copied in case an
account gets compromised or disgruntled employee
threatens to destroy data
○ (coupled with least privilege, any employee should have limited,
need-to-know access)

11. Do Good,
Find a way
Product Architecture - only
holder of root
● Don’t, ever, pass down root credentials
● Have Product Architecture hold root key
● Product Architecture creates and gives lesser credentials
for devs to execute
● Eliminate Root Actions – no actions where an engineer
needs a root password
● Adopt a key management system, such as Amazon’s KMS
● Ok .. here is one case where we need to remember our
mainframe days

12. Do Good,
Find a way
Billing setup & triggers can
provide intelligence
● Billing triggers - caps, activity, party, and more - Not just
cost savings
● Allows for detecting and providing additional insights
(i.e., crypto server)
● Account Service Owners
● Be sure 1 employee can’t walk away with full ownership

13. Do Good,
Find a way
Maintain only your domain email
accounts “own” access
● Deny / Remove non-business managed email accounts on
the Cloud
● This allows for better control in the future in the event
things go south, really really south

14. Do Good,
Find a way
Massive Gratitude

15. Do Good,
Find a way
"Every Damn Time"
Hacks/Insecurities
and Best Practices
that Prevent Them
- Thank you to everyone for
your help and insight

16. Do Good,
Find a way
A few sources
● Azure Best Practices
Repository
○ https://docs.microsoft.com/en-
us/azure/security/security-best-
practices-and-patterns
● “Breaking the Intrusion Kill
Chain with AWS”
○ https://d1.awsstatic.com/whitepap
ers/Break-Intrusion-Kill-Chains-
with-AWS.pdf